Does regenerating the session ID on each request mitigate the probability of a session hijack enough to be worth implementing? I would imagine combining a check for REMOTE_ADDR vs the REMOTE_ADDR ...
I was wondering if anyone knows what the most secure user access plugin for Rails is, and if any of them prevent session fixation?
What security benefits would randomizing cookie names on a website offer? What are some of the challenges it would create?
What are some good practices for ensuring logins, session IDs and session content are secure for a website?