private function secureSession()
    {
        $expired = false;
        if ($this->has('session_mgmt', 'destroyed'))
        {
            $when = $this->get('session_mgmt', 'destroyed');
            $ua = $this->get('session_mgmt', 'last_ua');
            $ip = $this->get('session_mgmt', 'last_ip');

            $now = time();
            $diff = $now - $when;

            if ($diff > Date::SECONDS_IN_MINUTE)
            {
                // The session exists, but it was expired more than 1 minute ago,
                // so its ready to be deleted.
                // @codeCoverageIgnoreStart
                // Testing this would increase the test duration by 1 minute.
                $expired = true;
                // @codeCoverageIgnoreEnd
            }
            elseif ($ua === $this->server_vars['HTTP_USER_AGENT'] && $ip === $this->server_vars['REMOTE_ADDR'])
            {
                // If UA and IP match, we can redirect to the new sesssion
                // within 1 minute to avoid session loss on bad connections.
                $new_session = $this->get('session_mgmt', 'new_session_id');
                if (!empty($new_session))
                {
                    session_commit(); 
                    ini_set('session.use_strict_mode', 0);
                    session_id($new_session);
                    session_start();
                    ini_set('session.use_strict_mode', 1);
                    $this->session_id = session_id();
                }
                else
                {
                    // The old session does not contain redirect information,
                    // so it was closed, not changed. Destroy it now.
                    $expired = true;
                }
            }
            else
            {
                // This seems like a hi-jack attempt, make sure to destroy the old session
                $expired = true;
            }
        }

        if ($expired)
        {
            // Shut down expired session completely
            $this->clear();
            $this->resetID();
        }

        // Check if it's time to regenerate the session ID
        if ($this->has('session_mgmt', 'start_time'))
        {
            $start = $this->getInt('session_mgmt', 'start_time');

            $now = time();
            $elapsed = $now - $start;
            $interval = Date::SECONDS_IN_DAY * 5;
            if ($elapsed > $interval)
                $this->resetID();
        }
        else
            $this->set('session_mgmt', 'start_time', time());

        // Store the current user agent and IP address to prevent session hijacking
        $this->set('session_mgmt', 'last_ip', $this->server_vars['REMOTE_ADDR']);
        $this->set('session_mgmt', 'last_ua', $this->server_vars['HTTP_USER_AGENT']);
    }
private function secureSession()
    {
        $expired = false;
        if ($this->has('session_mgmt', 'destroyed'))
        {
            $when = $this->get('session_mgmt', 'destroyed');
            $ua = $this->get('session_mgmt', 'last_ua');
            $ip = $this->get('session_mgmt', 'last_ip');

            $now = time();
            $diff = $now - $when;

            if ($diff > Date::SECONDS_IN_MINUTE)
            {
                // The session exists, but it was expired more than 1 minute ago,
                // so its ready to be deleted.
                // @codeCoverageIgnoreStart
                // Testing this would increase the test duration by 1 minute.
                $expired = true;
                // @codeCoverageIgnoreEnd
            }
            elseif ($ua === $this->server_vars['HTTP_USER_AGENT'] && $ip === $this->server_vars['REMOTE_ADDR'])
            {
                // If UA and IP match, we can redirect to the new sesssion
                // within 1 minute to avoid session loss on bad connections.
                $new_session = $this->get('session_mgmt', 'new_session_id');
                if (!empty($new_session))
                {
                    session_commit(); 
                    ini_set('session.use_strict_mode', 0);
                    session_id($new_session);
                    session_start();
                    ini_set('session.use_strict_mode', 1);
                    $this->session_id = session_id();
                }
                else
                {
                    // The old session does not contain redirect information,
                    // so it was closed, not changed. Destroy it now.
                    $expired = true;
                }
            }
            else
            {
                // This seems like a hi-jack attempt, make sure to destroy the old session
                $expired = true;
            }
        }

        if ($expired)
        {
            // Shut down expired session completely
            $this->clear();
            $this->resetID();
        }

        // Check if it's time to regenerate the session ID
        if ($this->has('session_mgmt', 'start_time'))
        {
            $start = $this->getInt('session_mgmt', 'start_time');

            $now = time();
            $elapsed = $now - $start;
            $interval = Date::SECONDS_IN_DAY * 5;
            if ($elapsed > $interval)
                $this->resetID();
        }
        else
            $this->set('session_mgmt', 'start_time', time());

        // Store the current user agent and IP address to prevent session hijacking
        $this->set('session_mgmt', 'last_ip', $this->server_vars['REMOTE_ADDR']);
        $this->set('session_mgmt', 'last_ua', $this->server_vars['HTTP_USER_AGENT']);
    }
private function secureSession ( ) { $ expired = false ; if ( $ this -> has ( 'session_mgmt' , 'destroyed' ) ) { $ when = $ this -> get ( 'session_mgmt' , 'destroyed' ) ; $ ua = $ this -> get ( 'session_mgmt' , 'last_ua' ) ; $ ip = $ this -> get ( 'session_mgmt' , 'last_ip' ) ; $ now = time ( ) ; $ diff = $ now - $ when ; if ( $ diff > Date :: SECONDS_IN_MINUTE ) { // The session exists, but it was expired more than 1 minute ago, // so its ready to be deleted. // @codeCoverageIgnoreStart // Testing this would increase the test duration by 1 minute. $ expired = true ; // @codeCoverageIgnoreEnd } elseif ( $ ua === $ this -> server_vars [ 'HTTP_USER_AGENT' ] && $ ip === $ this -> server_vars [ 'REMOTE_ADDR' ] ) { // If UA and IP match, we can redirect to the new sesssion // within 1 minute to avoid session loss on bad connections. $ new_session = $ this -> get ( 'session_mgmt' , 'new_session_id' ) ; if ( ! empty ( $ new_session ) ) { session_commit ( ) ; ini_set ( 'session.use_strict_mode' , 0 ) ; session_id ( $ new_session ) ; session_start ( ) ; ini_set ( 'session.use_strict_mode' , 1 ) ; $ this -> session_id = session_id ( ) ; } else { // The old session does not contain redirect information, // so it was closed, not changed. Destroy it now. $ expired = true ; } } else { // This seems like a hi-jack attempt, make sure to destroy the old session $ expired = true ; } } if ( $ expired ) { // Shut down expired session completely $ this -> clear ( ) ; $ this -> resetID ( ) ; } // Check if it's time to regenerate the session ID if ( $ this -> has ( 'session_mgmt' , 'start_time' ) ) { $ start = $ this -> getInt ( 'session_mgmt' , 'start_time' ) ; $ now = time ( ) ; $ elapsed = $ now - $ start ; $ interval = Date :: SECONDS_IN_DAY * 5 ; if ( $ elapsed > $ interval ) $ this -> resetID ( ) ; } else $ this -> set ( 'session_mgmt' , 'start_time' , time ( ) ) ; // Store the current user agent and IP address to prevent session hijacking $ this -> set ( 'session_mgmt' , 'last_ip' , $ this -> server_vars [ 'REMOTE_ADDR' ] ) ; $ this -> set ( 'session_mgmt' , 'last_ua' , $ this -> server_vars [ 'HTTP_USER_AGENT' ] ) ; }
Secure the session

This method checks if the session was destroyed, and if so, if a redirect to a new
session should be done. The new session ID is stored and will be sent to the client iff:

- Less than 1 minute has passed since the previous session was destroyed
- The client has the same user agent and IP-address as when the session was destroyed

If this is not the case, a new session is started and sent to the client. This method
also stores the current User Agent and IP address to the session.
Secure the session