Re: [PHP4BETA] Forcing a new Session ID?

On Mon, Oct 25, 1999 at 08:25:20PM -0400, Jon E. Mitchiner wrote: > Im trying to implement some security routines with the Session ID processing > so if someone tries hijacking someone else's session based on certain > variables that fail then they will be forced to get a new session id. > > Ive been trying to figure this out, but have had no luck. What would be the > best way to do this -without- destroying the existing user's session. If you think that a specific session was hijacked, destroy the session. I don't see any point in trying to rescue the session (if a session id was leaked once, there is a high propability that it will happen again). Thus, we supply only session_destroy(). -- Regards, Sascha Schumann Consultant