How do i fix Session Fixation in PHP

Question

How do i fix Session Fixation in PHP/cakephp. I am on a shared host.

EDIT i am on a shared host how can i enable it if i dont have aces to php.ini

Answer 1

http://en.wikipedia.org/wiki/Session_fixation#Countermeasures

Do a little bit of searching first, okay? ;)

Answer 2

• Set session.use_only_cookies=true. It's harder with cookies than POST/GET parameters to inject and/or social-engineer a session id.
• Set session.cookie_httponly=true. Not really because of session fixation but session hijacking ...anyway, there shouldn't be a good reason for a client-side script to be able to read the session id cookie.
• Use session_regenerate_id() as often as you deem necessary; at minimum every time a login is attempted.