I am looking at the session management again of a site and currently it renews the client session id on every page refresh. The idea being that if it is stolen directly from the browser there is less chance of the session being hijacked.
This though doesn't seem to make sense. If it is possible for some kind of malware or browser vulnerability to output a session id to a hacker, then they should quite easily be able to hijack that session regardless of the new session being created each time, as they would 'get there first'.
From what I can tell there is simply no way to solve that kind of issue by focussing on the session token itself but rather matching other users profile information is more reliable. And of course asking for the password for critical changes.
So is there any point at all in creating an new session token for every page load, it seems a bit pointless and a waste of resources. In fact if so many ids are being created there would be a higher chance of guessing a session randomly.
Would not changing the session token at all be acceptable during a session or should it maybe renewed every couple of minutes?