Change sessionid to something non-guessable ------------------------------------------- Key: TEIID-329 URL: https://jira.jboss.org/jira/browse/TEIID-329 Project: Teiid Issue Type: Task Components: Server Affects Versions: 6.0.0 Reporter: Steven Hawkins Assignee: Steven Hawkins Fix For: 6.1.0 Original Estimate: 1 day Remaining Estimate: 1 day Currently the sessionid is based upon a long sequence. It is extremely easy to exploit and then hijack a session. Sessionids should instead be based upon something that is hard to guess (such as a UUID) and should also be encrypted when being returned to the server or resent from the client.