note 61070 deleted from function.session-regenerate-id by peehaa
| From: | peehaa@php.net | Date: | Mon, 13 Mar 2017 10:20:48 +0000 |
| Subject: | note 61070 deleted from function.session-regenerate-id by peehaa | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-208902@lists.php.net to get a copy of this message | ||
Note Submitter: Gant at BleachEatingFreaks dot com
----
I am calling session_regenerate_id() from inside a method in an object. Since session fixation can
occur at permission changes, I have my object call session fixation at these particular security
changes.
Unfortunately, it seems to fabricate some kind of temporary new session, and then the very next page
that loads, it jumps back to the old session id. There seems to be no way to make the regeneration
perminent.