{"action":"opened","issue":{"url":"https://api.github.com/repos/fuel/core/issues/1838","labels_url":"https://api.github.com/repos/fuel/core/issues/1838/labels{/name}","comments_url":"https://api.github.com/repos/fuel/core/issues/1838/comments","events_url":"https://api.github.com/repos/fuel/core/issues/1838/events","html_url":"https://github.com/fuel/core/issues/1838","id":58868178,"number":1838,"title":"[SECURITY FLAW] \\Session_Driver uses MD5 for session IDs","user":{"login":"CozyLife","id":8941225,"avatar_url":"https://avatars.githubusercontent.com/u/8941225?v=3","gravatar_id":"","url":"https://api.github.com/users/CozyLife","html_url":"https://github.com/CozyLife","followers_url":"https://api.github.com/users/CozyLife/followers","following_url":"https://api.github.com/users/CozyLife/following{/other_user}","gists_url":"https://api.github.com/users/CozyLife/gists{/gist_id}","starred_url":"https://api.github.com/users/CozyLife/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/CozyLife/subscriptions","organizations_url":"https://api.github.com/users/CozyLife/orgs","repos_url":"https://api.github.com/users/CozyLife/repos","events_url":"https://api.github.com/users/CozyLife/events{/privacy}","received_events_url":"https://api.github.com/users/CozyLife/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-02-25T08:38:49Z","updated_at":"2015-02-25T08:38:49Z","closed_at":null,"body":"**The Problem**\r\nMD5 is well known for hash collision attacks, and therefore should only be used when security is not of any concern. Sessions are of course how a web application maintains state, and also are partly responsible for keeping user data specific to one user, only accessible to that user. Therefore, storing session IDs with an MD5 hash could cause unauthorized account access, probably only indeliberately, or could overwrite user data on another user's session.\r\n\r\n**Proposed Fix**\r\nUse something from the Sha-2 array of hashes for storing the ID. Sha-256 is of course the most common, and is quite secure enough for Sessions.\r\n\r\n[\\Session\\Driver at L#478](https://github.com/fuel/core/blob/1.8/develop/classes/session/driver.php#L478)\r\n"}}