New answers tagged session-fixation
Your scheme is problematic from a UX and Security standpoint. Bad UX, If implemented properly a user who logs in on their phone will immediately be logged out on their computer, or whatever. There are several other problematic cases where users who shouldn't be logged out are logged out. That's not horrible, but depending on the use of your application is ...
this is simple. first set the session cookie's HttpOnly use TLS ssl, meaning you have everything encrypted and modifications are detected set cookie.secure prevent any XSS, sql injection, or any other injection then you should generate new session at every login and invalidate old sessions that should be all against session hijacking
best way is following some tutorial http://www.wikihow.com/Create-a-Secure-Session-Managment-System-in-PHP-and-MySQL for safely destroy session_unset(); session_destroy();
Top 50 recent answers are included