How can PHP developers ensure the security of session IDs stored in cookies?

To ensure the security of session IDs stored in cookies, PHP developers can use the session_regenerate_id() function to generate a new session ID for each request. This helps prevent session fixation attacks where an attacker sets a known session ID to hijack a user's session. Additionally, developers should set the session cookie parameters to secure and httponly to prevent the session ID from being accessed by client-side scripts.

// Start the session
session_start();

// Regenerate the session ID
session_regenerate_id();

// Set session cookie parameters
session_set_cookie_params([
    'lifetime' => 0,
    'path' => '/',
    'domain' => 'example.com',
    'secure' => true,
    'httponly' => true
]);