bad ssl sessionid containing null byte

Hi unRuleY,

 

 

I think that would be worse.

 

If the client creates a 128Bit Session Id and there 16 Bit

 

missing that could mathematically

 

generate 65536 diffrent session that look like the same.

 

 

And thats bad bad for secure ecommerce (beside propper session handling)!

 

 

Regards,

 

Edi

 

 

P.S. Of corse we do _not_ rely on the ssl sessionid as a the only

 

session handler, but others may! Who knows what other side effects

 

this may cause!