regenerating session id

Question

I am thinking of using this code on every page to reduce the possibility of session hijacking. By renewing the session_id on every request

if(!empty($_sessio         


        

Answer 1

I had problems indeed (on page refresh or inside ajax requests), using session_regenerate_id(true); on each request.

But not with session_regenerate_id();

So, according to

Renew the Session ID After Any Privilege Level Change https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Renew_the_Session_ID_After_Any_Privilege_Level_Change

Regenerate SID on each request http://en.wikipedia.org/wiki/Session_fixation#Regenerate_SID_on_each_request

i use

• session_regenerate_id(); on each request
• session_regenerate_id(true); on login, logout etc (any privilege level change)