Secure login

Session fixation und session id validierung

Zitat:

```
Current Solution

Programmer can make adoptive session with user land code as follows.

Login code fragment: Code that adds session ID as validation key.

session_destory();
session_regenerate_id();
$_SESSION['valid_id'] = session_id();
Validation code: Code other than login. Check if session is properly initilized.

if ($_SESSION['valid_id'] !== session_id()) {
  die('Invalid use of session ID');
}
Alternatively, programmers may try to delete all possible cookies by sending empty session ID cookie.
```

Siehe https://wiki.php.net/rfc/strict_sessions