PHP Academy · Lesson

Session Security Best Practices

Prevent session fixation and hijacking with regeneration and flags.

Session Fixation Attack

An attacker tricks a user into using a session ID the attacker already knows, then hijacks the session after login.

After any privilege change (login, role change), generate a new session ID while keeping existing session data.

<?php
session_start();
// After successful login:
session_regenerate_id(true); // true = delete old session file
$_SESSION["user_id"] = $userId;