Question

I am trying to reset the session cookie, and its life, when the user logs in in PHP.
It sounds pretty trivial but I am still struggling to make it right.

When the page is loaded, the user may or may not alreay have a cookie. If he has one, I want to delete it and reset the sessionId, if not I will just give him a new one with the proper life. I cannot use session_status() because of the PHP version I am using.

Here is what I came up with but it does not work when the user already has a session cookie.

if (isset($_COOKIE[session_name()])) setcookie(session_name(), false);
session_set_cookie_params(2678400); // sets cookie life to one month
session_start();
// do stuff

When the user is logged in, the old cookie is normally deleted but session_start() does not deliver a new cookie. It there a way to force delivering a new cookie without having to manually implement the logic of session id creation?

Thanks a lot for your help

Answer 1

You don’t have to destroy/restart the session on the PHP side, you just have to send a new cookie to the client. Just call setcookie() again (with the existing session id), that should do the trick.