title: PHP best practices to prevent session hijacking in authentication
body: <blockquote>
    <p><strong>Possible Duplicate:</strong><br>
    <a href="https://stackoverflow.com/questions/12233406/preventing-session-hijacking">Preventing session hijacking</a>  </p>
  </blockquote>
  
  
  
  <p>I am coding up my login and authentication system for a <code>PHP</code> web application and looking for best practices to prevent session hijacking. The login page set's sessions:</p>
  
  <pre><code>$_SESSION['email_address'] = $_POST['email_address'];
  $_SESSION['ip_address'] = $_SERVER['REMOTE_ADDR'];
  </code></pre>
  
  <p>Then in every page and action I check to make sure the session exists, and the ip address stored in the session matches the ip address in $_SERVER['REMOTE_ADDR'].</p>
  
  <pre><code>if(isset($_SESSION['email_address']) &amp;&amp; isset($_SESSION['ip_address']) &amp;&amp; $_SESSION['ip_address'] == $_SERVER['REMOTE_ADDR']) {
       //valid auth
  }
  </code></pre>
  
  <p>Reading online though, some people say simply checking the ip address is NOT good enough. What else is needed? Also, there is talk of using <code>session_regenerate_id()</code>. How does that factor into my code? Do I call <code>session_regenerate_id()</code> on every page?</p>
  
  <p>Thanks.</p>