Session Security Best Practices
Prevent session fixation and hijacking with regeneration and flags.
Session Security Best Practices is a free PHP Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the PHP Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Session Fixation Attack
An attacker tricks a user into using a session ID the attacker already knows, then hijacks the session after login.
Prevent Fixation: session_regenerate_id()
After any privilege change (login, role change), generate a new session ID while keeping existing session data.
<?php
session_start();
// After successful login:
session_regenerate_id(true); // true = delete old session file
$_SESSION["user_id"] = $userId;Session Hijacking
An attacker steals the session ID via network sniffing, XSS, or log leakage. Mitigate with HTTPS, HttpOnly cookies, and fingerprinting.
session.cookie_httponly
Prevent JavaScript from reading the session cookie — stops most XSS-based session theft.
<?php
ini_set("session.cookie_httponly", 1);
session_start();session.cookie_secure
Mark the session cookie as Secure so it is only sent over HTTPS.
<?php
ini_set("session.cookie_secure", 1);
session_start();session.cookie_samesite
Set SameSite to Strict or Lax to prevent CSRF attacks that use the session cookie.
<?php
ini_set("session.cookie_samesite", "Strict");
session_start();User Agent Binding
Store the User-Agent in the session at login and verify on every request to detect hijacking.
<?php
if (!isset($_SESSION["ua"])) {
$_SESSION["ua"] = $_SERVER["HTTP_USER_AGENT"];
} elseif ($_SESSION["ua"] !== $_SERVER["HTTP_USER_AGENT"]) {
session_destroy();
die("Session invalid");
}Session Timeout
Implement activity-based timeouts — log out inactive users automatically.
<?php
$timeout = 1800;
if (isset($_SESSION["last_active"]) &&
time() - $_SESSION["last_active"] > $timeout) {
session_destroy();
header("Location: /login");
exit;
}
$_SESSION["last_active"] = time();session.use_strict_mode
Enable strict mode so the server rejects unrecognized session IDs — prevents session fixation via URL injection.
<?php
ini_set("session.use_strict_mode", 1);
session_start();Custom Session Handlers
Storing sessions in Redis or a database lets you centrally invalidate all sessions for a user and monitor active sessions.
Periodic Regeneration
Even during a long authenticated session, regenerate the session ID every 15-30 minutes to reduce token theft risk.
Summary
Always: use HTTPS, set HttpOnly+Secure+SameSite flags, call session_regenerate_id(true) after login, implement idle timeouts, and use strict mode.
Quick Check
What does session_regenerate_id(true) do?
Frequently asked questions
Is the “Session Security Best Practices” lesson free?
Yes — the full text of “Session Security Best Practices” is free to read here on the web, and the PHP Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the PHP Academy course, upgrade to CoddyKit PRO.
What will I learn in “Session Security Best Practices”?
Prevent session fixation and hijacking with regeneration and flags. You practise PHP Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start PHP Academy?
No prior experience is required. PHP Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Session Security Best Practices” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this PHP Academy lesson?
Yes. Every PHP Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Starting and Using Sessions
- Session Security Best Practices
- Setting and Reading Cookies
- Cookie Security: HttpOnly and Secure Flags