redaxo/redaxo — pull request #323 by staabm (2013-08-30 14:05:03+00:00)
Title: Secure login

Session fixation und session id validierung

Zitat:

```
Current Solution

Programmer can make adoptive session with user land code as follows.

Login code fragment: Code that adds session ID as validation key.

session_destory();
session_regenerate_id();
$_SESSION['valid_id'] = session_id();
Validation code: Code other than login. Check if session is properly initilized.

if ($_SESSION['valid_id'] !== session_id()) {
die('Invalid use of session ID');
}
Alternatively, programmers may try to delete all possible cookies by sending empty session ID cookie.
```

Siehe https://wiki.php.net/rfc/strict_sessions