What are some best practices for verifying the sessionID on secured pages in PHP?

When verifying the sessionID on secured pages in PHP, it is important to check if the session is valid and belongs to the user accessing the page. One way to do this is by comparing the sessionID stored in the session cookie with the sessionID stored in the server-side session data. 

session_start();

if (isset($_SESSION['user_id']) && isset($_COOKIE['PHPSESSID'])) {
    if ($_SESSION['session_id'] !== $_COOKIE['PHPSESSID']) {
        // Invalid session, redirect to login page
        header("Location: login.php");
        exit();
    }
} else {
    // Session or cookie not set, redirect to login page
    header("Location: login.php");
    exit();
}

Keywords

sessionID verification secured pages PHP best practices

Related Questions