Is it safe to have simple integer conversation IDs?

[dhinojosa]

Seems like a bad thing waiting to happen by having conversationIDs like 1,2,3,4,5.... For example in a shopping cart process.

Does anyone else have the same concern?

[matt.drees]

What kind of badness are you worried about?

[dhinojosa]

Just the standard hijacking, knowing that there is a possibility of say <1000 conversationIds for a standard run of the mill shopping cart site.

[jazir1979]

You can only access conversations that were initiated from your session.

If you are worried about session hijacking then fine, but it has nothing to do with integer conversation IDs.

"dhinojosa" wrote:
Just the standard hijacking, knowing that there is a possibility of say <1000 conversationIds for a standard run of the mill shopping cart site.

[dhinojosa]

That's exactly what I wanted to know. thanks jazir1979.