our IT Security team is asking us about how Appian is using Session Tokens. Cou

our IT Security team is asking us about how Appian is using Session Tokens. Could you please help me to address some of there questions?

Is the session token use unique, non-predictable and resistant to reverse engineering?
Does the session token contain only session related information?
Does the session token become invalid after clicking the logout button? Users must re-authenticate and are issued a new session token when logging on again.
Does the application have a large session token to be less vulnerable to brute force attacks? [Note: At the time of this writing 128-bit token space is sufficient to defeat brute force attack. As processing power and available bandwidth increases the required size shall increase as well. ]

OriginalPostID-185664

OriginalPostID-185664