What are common pitfalls when using PHP sessions for user authentication in a web application?

One common pitfall when using PHP sessions for user authentication is not properly securing the session data, which can lead to session hijacking or session fixation attacks. To mitigate this risk, it is important to use session_regenerate_id() to generate a new session ID after a user logs in or changes privilege level.

// Start the session
session_start();

// Regenerate session ID to prevent session fixation attacks
session_regenerate_id(true);