PHP "Session_regenerate_id" and "User Authentication"

Question

I am creating a login function on my website and I am thinking of updating the session id on each page to make things more secure.

I read PHP: regeneration information, but the messages on the PHP page are very different from the information they provide about session_regenerate_id.

Can someone explain these two questions:

• Do I need to copy the old session data to the newly created one, or is it done automatically? Code examples are much appreciated ...
  

• How to check if a user is registered? What should be stored in a session variable and how? Code examples are much appreciated ...

thanks

Answer 1

Calling session_regenerate_id () on each page may be a little redundant, depending on your setup. This feature is used to prevent session hijacking and should be used when a user raises privileges (for example, logging in). Usually you switch to an https connection after the user logs in, which means that you only need to call session_regenerate_id () once, when a new cookie is transmitted through a secure connection and cannot be tapped. However, if you do not have an SSL certificate on your server, regenerating the session cookie on each page may be a good option.

When calling session_regenerate_id () you do not need to copy the session data. All this will take care of you with PHP. Basically, a new session token and cookie are created, the session data is copied to the session store that should be associated with the new token, and if you pass true as the only argument to the function, the old session data file on disk will be deleted.

What you store in the session to indicate whether the user is registered is up to you. I just simply keep a simple boolean to indicate if they are logged in, as well as other values ​​containing usernames, name, etc. Then verifying that someone is logged in is simple like this:

<?php if ($_SESSION['logged_in']){ //User logged in } else { //User not logged in } ?> 

NTN.