note 129448 added to class.sessionhandler

Be aware that when you inherit from \SessionHandler you implicitly disable session strict mode because it doesn't implement SessionUpdateTimestampHandlerInterface (see: https://www.php.net/manual/en/session.configuration.php#ini.session.use-strict-mode) thus validateId() is not called. It's CRUCIAL to call the session_regenerate_id() function whenever any privilege level is changed (i.e. during authentication, password/permission/user role change) to mitigate the session fixation attack! ---- Server IP: 45.112.84.4 Probable Submitter: 80.90.13.131 (proxied: 84.55.60.33) ---- Manual Page -- https://php.net/manual/en/class.sessionhandler.php Edit -- https://main.php.net/note/edit/129448 Del: integrated -- https://main.php.net/note/delete/129448/integrated Del: useless -- https://main.php.net/note/delete/129448/useless Del: bad code -- https://main.php.net/note/delete/129448/bad+code Del: spam -- https://main.php.net/note/delete/129448/spam Del: non-english -- https://main.php.net/note/delete/129448/non-english Del: in docs -- https://main.php.net/note/delete/129448/in+docs Del: other reasons-- https://main.php.net/note/delete/129448 Reject -- https://main.php.net/note/reject/129448 Search -- https://main.php.net/manage/user-notes.php