Re: session_destroy() but re-use session ID: security risk?

It all depends on the session info saved on the server. But if you destroy the session data using session_destroy() then the next time the script starts with session_start(), it should issue a new session ID. Are you sure it gives the same session ID? if it does do this, for the script that terminates the session, <?php session_start(); session_destroy(); session_start(); # This will create a new session ID session_destroy(); # instead of session_destroy(); I use this # setcookie(session_name(),"","","/"); ?> "Kirk Johnson" <kjohnson@zootweb.com> wrote in message news:B11731D518B5D61183C700A0C98BE0D9FFC023@chef... > Say an application, using sessions, has a "logout" button which destroys the > session data. Say, also, that a user clicks that button, but then logs back > into the site without first closing their browser. Under these > circumstances, the session cookie and ID from their previous session will > get re-used for their new session. Is there any harm in this, from a > security viewpoint, or otherwise? > > TIA > > Kirk >