codeigniter - Regenerating PHP session ID and double refresh - browser not recieveing the new cookie -


i've replaced buggy codeigniter session library own native session implementation.

both act in same way, , change session id after period of time, , both suffer same issue, sake of question lets session regenerated each minute.

when user views page, , waits 1 minute, on next page request session id regenerated. there issue when users request times out or if "double refresh" page. browser not receive new cookie, therefore starts new session on next request. if user hits refresh @ point in id regenerated , hits refresh again in quick succession, lose session.

i know changing session id idea prevent session fixation there way around issue? increasing time in id regenerated limit possibility of happening still seems happen.

thanks help!

  1. add column 'previous_session_id' db
  2. move current session id 'previous_session_id' - generate new session id , store in current_session_id
  3. when user tries access page session id - check current id , 'previous_session_id'

problem solved - can 'double refresh' , still access page.


Comments