From e51081341b1d405154f4434c77361656178e3dd7 Mon Sep 17 00:00:00 2001 From: Nicolas Chavez Date: Fri, 25 Feb 2022 13:15:10 -0500 Subject: [PATCH] Add guidance for cryptographically secure session ids. --- index.bs | 4 +++- index.html | 50 +++++++++++++++++++++++++------------------------- 2 files changed, 28 insertions(+), 26 deletions(-) diff --git a/index.bs b/index.bs index 70fd9d1..0b59247 100644 --- a/index.bs +++ b/index.bs @@ -2547,7 +2547,9 @@ In JavaScript, `JSON.stringify()` performs serialization; `JSON.parse()` - deser The media player may manage several ads that are in different phases of their lifespans; multiple concurrent sessions may be active. For example, while the player is rendering ad-A, it preloads and engages ad-B. Simultaneous two-way communication between the player and both ads persists. -Each session has a unique identifier. All messages that belong to a specific session must reference the same session id. +Each session has a unique identifier. All messages that belong to a specific session must reference the same session id. The session id must be cryptographically safe to prevent brute force attacks that would try to guess the session id and spoof as the creative or player. + +Note: A robust implementation like `window.crypto.getRandomValues` or `window.crypto.randomUUID` is recommended. ### Establishing a New Session ### {#protocol-establish-session} diff --git a/index.html b/index.html index 0d68495..b5fbdd7 100644 --- a/index.html +++ b/index.html @@ -1489,7 +1489,6 @@ -