The value of a session cookie is short or has a very limited character set, so the number of possible identifiers is small enough to be tried one by one. An attacker that finds a valid identifier takes over that user's session.

Rapplex estimates the entropy from the length and character classes of the value and from how varied its characters are. Fewer than 64 bits is considered weak. The estimate is an upper bound: an identifier that looks weak here is weak, one that passes may still be predictable if it is generated badly.

1. Let the framework generate session identifiers and do not build them from user data, timestamps, counters or the process' general purpose random generator.

2. Use at least 128 bits of cryptographic randomness, which is 16 random bytes encoded as 22 or more characters.

3. Rotate the identifier on login and invalidate all existing sessions after the change.

• CWE-331: Insufficient Entropy
• OWASP Session Management Cheat Sheet