Edit Question - KnowledgeHub

Title Body

I'm testing the implementation of a security check in my PHP sessions. I can successfuly detect whether the session was started from another IP address and I can successfully start a new session. However, the data from the old session gets copied into the new one! How can I start a blank session while preserving the previous session data for its legitimate owner? This is my code so far, after lots of failed attempts: <?php // Security check if( isset($_SESSION['ip_address']) && $_SERVER['REMOTE_ADDR']!=$_SESSION['ip_address'] ){ // Check failed: we'll start a brand new session session_regenerate_id(FALSE); $tmp = session_id(); session_write_close(); unset($_SESSION); session_id($tmp); session_start(); } // First time here if( !isset($_SESSION['ip_address']) ){ $_SESSION['ip_address'] = $_SERVER['REMOTE_ADDR']; $_SESSION['start_date'] = new DateTime; } The official documentation about sessions is terribly confusing :( Update: I'm posting some findings I got through trial and error. They seem to work: <?php // Load the session that we will eventually discard session_start(); // We can only generate a new ID from an open session session_regenerate_id(); // We store the ID because it gets lost when closing the session $tmp = session_id(); // Close session (doesn't destroy data: $_SESSION and file remains) session_destroy(); // Set new ID for the next session session_id($tmp); unset($tmp); // Start session (uses new ID, removes values from $_SESSION and loads the new ones if applicable) session_start();

Tags (comma-separated) Cancel