StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POWouldn't regenerate_session_id regenerate the id for someone who intercepts a session id?
primarykey
Id
8745591
data
AcceptedAnswerId
8745742
AnswerCount
1
ClosedDate
CommentCount
2
CommunityOwnedDate
CreationDate
2012-01-05T16:03:40.067
FavoriteCount
0
LastActivityDate
2012-01-05T16:11:55.583
LastEditDate
LastEditorUserId
0
OwnerUserId
1094506
ParentId
0
PostTypeId
1
Score
1
ViewCount
181
LastEditorDisplayName
text
Body
<p>I'm having troubles understanding this, and I think my ignorance to web exploits is to blame. My understanding of session fixation goes like this:</p> <ul> <li>Hacker uses some exploit to retrieve the session id of a currently logged in user.</li> <li>Hacker uses session id to access the site, stealing the session and effectively logging in.</li> </ul> <p>It's been recommended that you use regenerate_session_id to reduce the chances the hacker can intercept the session. Now wouldn't that trigger regenerate_session_id, updating the hacker with the session id while simultaneously logging out the user who was originally logged in? This seems like it would cause more harm then good, so I know I must be missing something in the picture here. What am I missing?</p>
Tags
<php><security><session>
Title
Wouldn't regenerate_session_id regenerate the id for someone who intercepts a session id?
singulars
PostAcceptedAnswerId
1. PO
  singulars
  PostTypePostTypeId
  PTAnswer
PostParentId
1. This table or related slice is empty.
PostTypePostTypeId
1. PTQuestion
UserLastEditorUserId
1. This table or related slice is empty.
UserOwnerUserId
1. USACobbs
plurals
PostLinksPostIdRelatedPostId
1. This table or related slice is empty.
PostLinksRelatedPostIdPostId
1. This table or related slice is empty.
PostsAcceptedAnswerId
1. This table or related slice is empty.
PostsParentIdCreationDate
1. PO
  singulars
  PostTypePostTypeId
  PTAnswer
VotesPostIdCreationDate
1. VO
  singulars
  PostPostId
  POWouldn't regenerate_session_id regenerate the id for someone who intercepts a session id?
  UserUserId
  This table or related slice is empty.
  VoteTypeVoteTypeId
  VTUpMod
CommentsPostId
1. COIt reduces the likelihood that a hacker can hijack a session in the first place if the session id changes on every request
  singulars
  PostPostId
  POWouldn't regenerate_session_id regenerate the id for someone who intercepts a session id?
  UserUserId
  USMark Baker
2. COI've also read changing the session id on every request would be overkill and not worth it, which is something else that confused me. Is it really more costly to regenerate the id compared to enforcing stronger security?
  singulars
  PostPostId
  POWouldn't regenerate_session_id regenerate the id for someone who intercepts a session id?
  UserUserId
  USACobbs

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.