Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
The spec ( https://github.com/ulid/spec which is not a real standard ) explains that there are 80 random bits in an ULID. UUIDv4 is better from a security aspect, as it has 122 bits for randomness. But UUIDv4 has no monotonic sort order, and that would be very benefical in my actual application.
So how bad would it be to use ULIDs for session ids?
Almost certainly unsafe. If two or more ULIDs would be generated in the same millisecond, the "random" component is replaced by a counter. An attacker could issue requests, then try adding or subtracting 1 to see if they collided with an existing session. If the system is processing more than 1000 requests per second the attack becomes certain to succeed.
