Securing PHP Applications Against Session Hijacking

By Anastasia K.4 min readFebruary 9, 2026

Session hijacking typically involves an attacker intercepting or guessing a session ID, which can then be used to gain unauthorized access to a user's account. PHP provides mechanisms to mitigate these risks, but developers must configure and manage sessions correctly. Key strategies include using secure session cookies, regenerating session IDs, and protecting session storage.

Below are best practices and code examples to help you secure session handling in your PHP applications.

1. Use HTTPS for All Session-Cookie Transmissions

Ensure that all communication between the client and server is encrypted using HTTPS to prevent session IDs from being intercepted over the network.

// Set session cookie parameters to use HTTPS and be secure
session_set_cookie_params([
    'lifetime' => 0,
    'path' => '/',
    'domain' => 'example.com',
    'secure' => true,  // Only transmit over HTTPS
    'httponly' => true, // Prevent JavaScript access
    'samesite' => 'Strict' // Mitigate CSRF
]);

// Start session after setting cookie parameters
session_start();

2. Regenerate Session IDs After Login

Regenerating the session ID after a user logs in prevents session fixation attacks. This ensures that the session ID cannot be reused by an attacker.

// After successful authentication
session_regenerate_id(true); // true deletes the old session file

3. Store Sessions in a Secure Location

By default, PHP stores sessions in the system's temporary directory. You can change the session storage location to a more secure and isolated directory.

ini_set('session.save_path', '/var/www/session_data');

Ensure the directory has appropriate permissions and is not accessible via the web.

4. Implement Session Timeout and Inactivity Checks

Prevent long-lived sessions by setting a reasonable session lifetime and checking for user inactivity.

// Set session lifetime to 30 minutes
ini_set('session.gc_maxlifetime', 1800);
session_set_cookie_params(1800);

// Check last activity time
if (isset($_SESSION['LAST_ACTIVITY']) && (time() - $_SESSION['LAST_ACTIVITY'] > 1800)) {
    session_unset();
    session_destroy();
    die("Session expired due to inactivity.");
}
$_SESSION['LAST_ACTIVITY'] = time();

5. Validate Session Data on Every Request

Verify that the session data is consistent with the expected user state. For example, store the user's IP address and user agent in the session and compare them on each request.

if (!isset($_SESSION['ip']) || $_SESSION['ip'] !== $_SERVER['REMOTE_ADDR']) {
    session_unset();
    session_destroy();
    die("Session invalid due to IP mismatch.");
}

if (!isset($_SESSION['user_agent']) || $_SESSION['user_agent'] !== $_SERVER['HTTP_USER_AGENT']) {
    session_unset();
    session_destroy();
    die("Session invalid due to browser mismatch.");
}

Note: This method can have false positives when users change networks or use different devices. Use it with caution and consider context.

6. Use PHP Session Handlers for Custom Security

You can implement custom session handlers to store session data in a database or other secure storage. This is useful for large-scale applications or environments with specific compliance requirements.

class SecureSessionHandler implements SessionHandlerInterface {
    private $db;

    public function open($savePath, $sessionName) {
        $this->db = new PDO('mysql:host=localhost;dbname=secure_sessions', 'user', 'pass');
        return true;
    }

    public function close() {
        $this->db = null;
        return true;
    }

    public function read($id) {
        $stmt = $this->db->prepare("SELECT data FROM sessions WHERE id = ?");
        $stmt->execute([$id]);
        $row = $stmt->fetch(PDO::FETCH_ASSOC);
        return $row ? $row['data'] : '';
    }

    public function write($id, $data) {
        $stmt = $this->db->prepare("REPLACE INTO sessions (id, data, last_accessed) VALUES (?, ?, NOW())");
        return $stmt->execute([$id, $data]);
    }

    public function destroy($id) {
        $stmt = $this->db->prepare("DELETE FROM sessions WHERE id = ?");
        return $stmt->execute([$id]);
    }

    public function gc($max_lifetime) {
        $stmt = $this->db->prepare("DELETE FROM sessions WHERE last_accessed < NOW() - INTERVAL ? SECOND");
        return $stmt->execute([$max_lifetime]);
    }
}

$handler = new SecureSessionHandler();
session_set_save_handler($handler, true);
session_start();

7. Use Session Locking and Concurrency Control

PHP sessions are locked by default while a session is open, which can lead to performance issues in concurrent environments. You can unlock the session after reading or writing to allow other processes to access it.

// Start session and immediately unlock
session_start();
session_write_close();

// Later, when you need to update the session
session_start();
$_SESSION['key'] = 'value';
session_write_close();

Feature	PHP Default	Custom Handler
Session Locking	Enabled	Configurable
Storage	File-based	Database, Redis, etc.
Security	Moderate	High (if configured)
Scalability	Low \| High