Priority: P3 · Nature: hardening
Problem
session/redis.go:81-83 builds keys as prefix + sessionID with no validation of sessionID format/length. Not injection (Redis has no key-syntax injection), but an attacker-influenced sessionID can collide with another session's key if the prefix scheme isn't tenant-scoped.
Fix
Enforce an ID format (e.g. UUID) at the Session interface boundary and/or tenant-scope the key prefix.
Filed from a full-repo audit (branch main). Verified against source; baseline go vet/staticcheck/go test -race pass on the default build.
Priority: P3 · Nature: hardening
Problem
session/redis.go:81-83builds keys asprefix + sessionIDwith no validation ofsessionIDformat/length. Not injection (Redis has no key-syntax injection), but an attacker-influencedsessionIDcan collide with another session's key if the prefix scheme isn't tenant-scoped.Fix
Enforce an ID format (e.g. UUID) at the
Sessioninterface boundary and/or tenant-scope the key prefix.Filed from a full-repo audit (branch
main). Verified against source; baselinego vet/staticcheck/go test -racepass on the default build.