How can PHP sessions be prevented from being crawled with the PHPSESSID parameter in the URL?

PHP sessions can be prevented from being crawled with the PHPSESSID parameter in the URL by using session_regenerate_id() function to regenerate the session ID after authentication. This will prevent session fixation attacks and make it harder for attackers to hijack sessions by guessing the session ID from the URL. 

<?php
session_start();

// Check if user is authenticated
if($authenticated) {
    // Regenerate session ID
    session_regenerate_id();
}
?>

Keywords

PHP sessions PHPSESSID parameter URL crawling prevention

Related Questions