What potential pitfalls should be considered when using sessions in PHP?

One potential pitfall when using sessions in PHP is the risk of session fixation attacks, where an attacker can hijack a user's session by fixing their session ID. To prevent this, it is important to regenerate the session ID whenever a user's privilege level changes, such as during login. This can be done by calling session_regenerate_id(true) after verifying the user's credentials. 

// Verify user's credentials
if($valid_credentials) {
    session_regenerate_id(true);
    $_SESSION['logged_in'] = true;
    // Other session data
}

Keywords

session fixation session hijacking session_regenerate_id session_destroy session_set_cookie_params

Related Questions