What potential pitfalls can arise when implementing session-based user authentication in PHP?

One potential pitfall when implementing session-based user authentication in PHP is the risk of session hijacking. This occurs when an attacker gains access to a user's session ID and impersonates them. To mitigate this risk, it is important to regenerate the session ID after a successful login or privilege change.

// Regenerate session ID after successful login
session_start();
session_regenerate_id(true);