'sha1' hash algorithm used at index.js is unsafe about session HOT 3 CLOSED

✨: While SHA1 is considered insecure for cryptographic uses, its use in this codebase does not present a security risk. The hash is used internally by the server for the purpose of checking if the session object has changed, and is not exposed in a way that would allow it to be exploited by an attacker.

from session.

Hey! 👋 What type of attack vector are you concerned about based on how session uses sha1 to serialize and check for data integrity in a session during the req/res cycle?

from session.

Hi! thanks for the quick answer,
Regarding the type of attack, those are the ones that I am concerned:

Collision Attacks
Preimage Attacks
Length Extension Attacks
Cryptanalysis Advances

from session.