RE: [PHP] Re: session_destroy() but re-use session ID: security risk?

> Yes, the session ID is re-used, and a new, empty session file with the > same > name is created. I believe session_start() will only result in a new > session > ID being issued if the client didn't submit a cookie with an ID. In the > hypothetical example I gave, the client will send the cookie with an ID, > since a session cookie persists for the life of the browser instance. The only security risk I see is that you're letting the user supply their own session ID when they log in. You may be vulnerable to a "session fixation" attack. You're basically letting the user define their own session ID. A malicious user could create a URL link to a user to log into your site, supplying the session ID in the URL, thus simplifying the hijacking of that user's session once they log in (since they already know the session id). You can use md5() and uniqid() and session_id() to create your own session ids when users log in. As for the general idea of keeping the same session id after a user logs out, I don't see any issues as long as you're sure the data is wiped. ---John W. Holmes... PHP Architect - A monthly magazine for PHP Professionals. Get your copy today. http://www.phparch.com/