Question

I am thinking of using this code on every page to reduce the possibility of session hijacking. By renewing the session_id on every request

if(!empty($_session)){ 
   session_start(); 
}

Another way to achieve so would be to do this:

if(!empty($_session)){ 
  session_regenerate_id(true);
}

However, I heard criticisms of that function that say that if the page is refreshed too fast for some reason, the session id becomes invalid.

Another way to use the session id is to have more control over how a session is generated.

There are other ways to achieve so.. Whats the best practice?

Answer 1

Instead of generating session IDs,why don’t you encrypt and use the already generated one.It can be used and destroyed when the intended action is complete.