cfml

Is the sessionid a cryptographically secure value?

These are generated by ACF server session.

<@U0PNJPC31> I'm not aware of ColdFusion itself creating `sessionid`.

Are you sure your app code isn't creating that?

CF just creates CFID and CFToken as far as I'm aware

That session variable is actually likely coming from ColdBox

I have sessionmanage on and I simply log the value of "session" and I get those keys.

it's more like
• all you did was enable session man
• 1000's of lines of coldbox and app code ran
• your session scope had a variable

The answer to your question is likely "yes"

Whatever is creating that var is using the cftoken inside of it, which should be considered secure

right. My fallback is to use `java.security.SecureRandom`

its a param for a payload to Duo Security api service - part of the multi factor auth process.

I assume you're looking for
• a value that's different per user
• a value that can't easily be guessed

well I'm going to skip it and use hash or SecureRandom because this is for a forgebox module and I don't want the hard dependency on Coldbox.

You could use token directly, but Lucee doesn't use token in favor of putting a hash directly in cfide

But in either case, those both rely on session management

So best not to rely on either of them if possible for your 3rd party module

<@U06V253M4> `session.sessionId` _is_ a std CF thing. <https://helpx.adobe.com/coldfusion/developing-applications/developing-cfml-applications/using-persistent-data-and-locking/configuring-and-using-session-variables.html|https://helpx.adobe.com/coldfusion/developing-applications/developing-cfml-applicati[…]data-and-locking/configuring-and-using-session-variables.html>

I did just notice that cftoken is part of the sessionid in combination with cfid and I guess the application name in hex or something.

just supposed to be the application name. Thought it looked like a pretty bloody weird sessionId

```&lt;cfdump var="#[
    "application.name" = application.applicationname,
    "session.cfid" = session.cfid,
    "session.cftoken" = session.cftoken,
    "session.sessionId" = session.sessionId
]#" format="text"&gt;```
```struct (ordered)

application.name: sessionTests
session.cfid: 204
session.cftoken: 964945d98128491-7D884619-021C-4B7C-90573E92201E4052
session.sessionId: SESSIONTESTS_204_964945d98128491-7D884619-021C-4B7C-90573E92201E4052```
CF2021.

I was on that docs page earlier but I only keyword searching for "cryptographically" "crypto" "secure" to know for sure if any of the session data is a cryptographically secure value.
And yes it does say its supposed to be app name.

oh the coldbox app name by default in the template is `hash( getCurrentTemplatePath() )`