title: How to generate a secure session id
body: <p>for a C++ Web-Server I have to generate session id's. I thought of using some kind of random number and hash that with the initial IP address of the session and maybe a timestamp.</p>
  
  <p>Will this yield a reasonable unguessable ID? What would be a good random generator algorithm (most preferable one implemented by boost-random)?</p>
  
  <p>kind regards
  Torsten</p>
  
  <p>My solution now looks like: </p>
  
  <pre><code>std::string secure_session_generator::operator()( const char* /* network_connection_name */ )
  {
      std::stringstream out;
      out &lt;&lt; std::hex &lt;&lt; distribution_( generator_ );
  
      return out.str();
  }
  </code></pre>
  
  <p>with the members are default constructed:</p>
  
  <pre><code>    boost::random::random_device                                        generator_;
      boost::random::uniform_int_distribution&lt; boost::uint_least64_t &gt;    distribution_;
  </code></pre>