It keeps running in my mind the last couple of days, but I read some articles about how to make your PHP sessions more secure. Almost all of these articles say that you need to save the useragent in the session WITH an additional salt. Something like this:

```
$fingerprint = md5('SECRET-SALT'.$_SERVER['HTTP_USER_AGENT']);

```

The salt would make it harder for an attacker to hijack or whatever the session. But WHY add a salt every time you would check it like this:

```
md5('SECRET-SALT'.$_SERVER['HTTP_USER_AGENT']) == $_SESSION [ 'fingerprint' ]

```

So WHY would a salt make it more secure, since the attacker still only needs the useragent (which is relativly a small set of different useragents) and the sessionid?

Probably something small I'm overlooking, but can't figure it out, drives me crazy haha

Thanks!