Does regenerating the session ID on each request mitigate the probability of a session hijack enough to be worth implementing?
I would imagine combining a check for REMOTE_ADDR vs the REMOTE_ADDR stored in the session variables, along with a 30 minute inactivity timeout and a constantly changing session id should mitigate the risk to an acceptable level.
Additionally, are there any other concerns with regenerating a session id? Do I need to explicitly destroy the old session for each new regeneration?
Finally, would regenerating the session id on every request become too resource intensive on a large deployment to justify vs the security advantages?