why is php generating the same session ids everytime in test environment (WAMP)?

Question

i\'ve configured wamp in my system, and am doing the development cum testing in this local environment. i was working on the logout functionality, and happened to notice tha

Answer 1

You probably still have the cookie with the old session ID in it as neither session_unset nor session_destroy deletes that cookie:

In order to kill the session altogether, like to log the user out, the session id must also be unset. If a cookie is used to propagate the session id (default behavior), then the session cookie must be deleted. setcookie() may be used for that.

So use setcookie to invalidate the session ID cookie after logout:

if (ini_get("session.use_cookies")) {
    $params = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000,
        $params["path"], $params["domain"],
        $params["secure"], $params["httponly"]
    );
}

Another recommendation is to regenerate the session ID after successful authentication using session_regenerate_id(true).