What is the impact of using session_regenerate_id(true) on every page load in a PHP application?

Using session_regenerate_id(true) on every page load in a PHP application can improve security by preventing session fixation attacks. However, it can also lead to performance issues due to the constant regeneration of session IDs. It is recommended to use session_regenerate_id(true) strategically, such as after a user logs in or performs a sensitive action. 

<?php
session_start();

if (isset($_SESSION['logged_in']) && $_SESSION['logged_in'] === true) {
    // User is logged in, regenerate session ID
    session_regenerate_id(true);
}

// Rest of your PHP code
?>

Keywords

session_regenerate_id security session hijacking PHP application page load

Related Questions