Re: Inadvertant Session Hijacking

You can reimplement varios parts of session handling ( see session_set_save_handler() ) together with making your own (better) session id with session_id(), or implement your own session module ( session_module_name() ) Thomas Deliduka wrote:

Now this is not the malicious kind where a user intentionally takes over another session. I'm speaking of a case where the random session ID generator happens to give another user someone else's session whether active or inactive (inactive and not yet cleared by garbage collection). I had a case just this weekend where this happened, a user got another visitor's shopping cart. The potential is for someone to get another person's logged in session. The site I work with gets 5,000 unique visitors a day, it's a very very busy website and I'm thinking that garbage collection isn't up to snuff or that the random ID generation isn't quite random enough. What can I do about this? I have increased the percentage of garbage collection already, what else can I do?