What are the potential pitfalls of not properly managing session lifetimes in PHP?

Not properly managing session lifetimes in PHP can lead to security vulnerabilities such as session hijacking or session fixation attacks. To mitigate these risks, it is important to properly set session expiration times and regenerate session IDs periodically. 

// Set session lifetime to 30 minutes
ini_set('session.gc_maxlifetime', 1800);
session_start();

// Regenerate session ID every 30 minutes
if (isset($_SESSION['last_activity']) && time() - $_SESSION['last_activity'] > 1800) {
    session_regenerate_id(true);
    $_SESSION['last_activity'] = time();
}

Keywords

session management session hijacking session fixation session_regenerate_id session timeout

Related Questions