The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

N OT E

Some high-strength sources of randomness take some time to return

the next value in their output sequence because of the steps they take to

obtain sufficient entropy (from system events, etc.) and so may not deliver

values sufficiently fast to generate tokens for some high-volume applications.

In addition to selecting the most robust source of randomness that is feasi-

ble, a good practice is to introduce as a source of entropy some information

about the individual request for which the token is being generated. This

information may not be unique to that request, but it can be very effective in