为什么随机重新生成会话ID？

Question

Is this good practice? I've never seen it done before but it works well so far.

if(mt_rand(1, 10) == 1) {     # regenerate "randomly" on 10% of requests
    session_regenerate_id();
}

Thanks. :)

Answer 1

I think for whatever proper reason or context you would regenerate the session ID, you should do it every time, not just sometimes randomly (in your case a 10% basis). I don't see how doing it every time is bad practice (correct me if I'm wrong, I'd be curious as why). If someone has hacked a session, then regenerating the ID will cause "hacker" to lose their hacked session. If you only regenerate the ID 10% of the time, then there is a 90% chance they will still maintain their hacked session. No beuno.