title: use_strict_mode in php sessions
body: <p>Can anyone explain me what <a href="http://www.php.net/manual/en/session.configuration.php#ini.session.use-strict-mode" rel="noreferrer">use_strict_mode</a> in php.ini config is responsible for? In documentation it tells me the following:</p>
  
  <blockquote>
    <p>session.use_strict_mode specifies whether the module will use strict
    session id mode. If this mode is enabled, the module does not accept
    uninitialized session ID. If uninitialized session ID is sent from
    browser, new session ID is sent to browser. Applications are protected
    from session fixation via session adoption with strict mode. Defaults
    to 0 (disabled).</p>
  </blockquote>
  
  <p>My rudimentary understanding is that it creates always a session ID for you, but I already saw another <a href="http://www.php.net/manual/en/session.configuration.php#ini.session.auto-start" rel="noreferrer">config option</a> with does the same. So I assume that my understanding is wrong. So why do we need it? (The closest I saw is that it prevents OWASP A9, but it does not give me a lot of information).</p>