PHP prevents session pinning attacks

Issue: You want to ensure that the app is not subject to a session pinning attack, which means that the attacker forces the user to use a predefined session ID.

Solution: A session cookie is required but the session identifier is not appended to the URL, and a new session ID is generated frequently:

1<?PHP2 Ini_set(' Session.use_only_cookies ',true);3 //prevent session pinning attacks4 Session_Start();5 6 //generate a new phpsessid every 30 seconds7 if(!isset($_session[' generated ']) ||$_session[' Generated '] < ( Time()-30) ) {8     Echo"Create<br/>";9     //generate a new session IDTen     session_regenerate_id(); One     $_session= [ A' User ' = ' lemon ', -' Generated ' = Time() -     ]; the  -}Else { -     Echo"Ok<br/>"; -     Print_r($_session); +}

This approach basically eliminates the risk of session pinning attacks, and it is difficult for an attacker to get a valid session ID because the session ID will change frequently.

PHP prevents session pinning attacks