title: I don't understand why session_regenerate_id is dangerous with low connection?
body: <p>I'm working on security of my website and I would understand why session_regenerate_id should be use carefully.
  In the php manual doc (<a href="https://www.php.net/manual/en/function.session-regenerate-id.php" rel="nofollow noreferrer">https://www.php.net/manual/en/function.session-regenerate-id.php</a>) they say :</p>
  <blockquote>
  <p>Currently, session_regenerate_id does not handle an unstable network well, e.g. Mobile and WiFi network. Therefore, you may experience a lost session by calling session_regenerate_id.</p>
  <p>You should not destroy old session data immediately, but should use destroy time-stamp and control access to old session ID. Otherwise, concurrent access to page may result in inconsistent state, or you may have lost session, or it may cause client(browser) side race condition and may create many session ID needlessly. Immediate session data deletion disables session hijack attack detection and prevention also.</p>
  </blockquote>
  <p>I don't understand why this function could implies lost connections.
  We send a request to the server he change the SID (init $_SESSION with old values and create a file at save_file location) so he can sent a cookie to the client.</p>
  <p>Anybody can explain me where we can have a session lost ?
  I am really confused with that but I would understand this problem in order to fixe that...</p>
  <p>In advance, thanks all :D</p>
  <p>Ps : I also had reed the documentation on <a href="https://www.php.net/manual/en/function.session-regenerate-id.php" rel="nofollow noreferrer">https://www.php.net/manual/en/function.session-regenerate-id.php</a> and I don't understand the second exemple :</p>
  <pre><code>function my_session_start() {
  session_start();
  if (isset($_SESSION['destroyed'])) {
     if ($_SESSION['destroyed'] &lt; time()-300) {
         // Ne devrait pas se produire habituellement. Cela pourrait être une 
         // attaque ou en raison d'un réseau instable. Supprimez tout l'état 
         // d'authentification de cette session utilisateurs.
          remove_all_authentication_flag_from_active_sessions($_SESSION['userid']);
         throw(new DestroyedSessionAccessException);
     }
     if (isset($_SESSION['new_session_id'])) {
         // Pas encore complètement expiré. Pourrait être perdu cookie par réseau instable.
         // Essayez à nouveau de définir le cookie d'ID de session approprié.
         // Remarque: n'essayez pas de redéfinir l'ID de session si vous 
         // souhaitez supprimer l'état d'authentification.
         session_commit();
         session_id($_SESSION['new_session_id']);
         // Nouvel ID de session doit exister
         session_start();
         return;
     }
   }
  }
  </code></pre>
  <p>why if &quot;time()-300&quot; it could be an attack ?
  and also I don't understand why we should delete a session if it could be a network problem... It will be result in connection lost no ? I don't understand why we should raise an exeption ? Someone could help me ?</p>