First, I apologize if this question is off topic as defined here. If so, please let me know and I'll close it.
I'm building a sessions middleware for an http service and thought it might be a good idea to append hmac hashes of session id's, rather then setting bare session id's in cookies, but am a bit of a crypto novice. FYI - the service isn't protecting anything critical, it's just a side project of mine, which is why I'm rolling my own solution.
First, allow me to layout the general sessions design, and I'll follow with some specific questions. Here is an overview of my sessions service:
- Generate a random session id using an RFC 4122 version 4 uuid generator. I store this id in redis along with some other info (userID, expiry, etc.).
- Hash the byte array of this session id with hmac sha512. My hashing key was generated with openssl
$ openssl rand -base64 64
- Append the bytes of the hmac hash to the the byte array of the session id. Base64 encode the resulting array, stringify and set as an http only, secure cookie.
Upon receiving a request from a client, verifying the user session is basically the steps above, but in reverse.
My questions are:
- Does appending the hmac hash to the session id offer any benefit above and beyond simply setting a version 4 uuid to the cookie? My thought was that I could verify the hmac signature using my key before pinging my db to check if the session id was expired. This would cut down trips to my db if someone were trying to guess at session id's.
- Is sha512 overkill for hashing my session id? My understanding is that it should be faster on a 64 bit machine.
- Is appending the hashed bytes array to the session id bytes array, base64 encoding and stringifying the result the proper way of storing this information in a cookie?
$ openssl rand -base64 64the proper way of generating a key for my purposes? Based on this discussion, my understanding is that my key length should optimally be between 64 and 128 bytes.
- Anything else you want to add? Anything I've overlooked?
Thanks for your input. Cheers!