title: PHP session_regenerate_id(true) possible cookie race condition?
body: <p>I have a PHP login page (<em>login_page.php</em>) with <code>&lt;form method="post" action="login_handler.php&gt;</code>
  At the top of <em>login_page.php</em> I call <code>session_start();</code>
  I store a control string <code>$_SESSION['xss_check']</code> to prevent XXS.</p>
  
  <p>After a user enters username &amp; password and clicks login <em>login_handler.php</em> processes their credentials and redirects to the website logged in.
  Then at the top of <em>login_handler.php</em> I call <code>session_start()</code> again and <code>session_regenerate_id(true)</code></p>
  
  <p>To my understanding <code>session_regenerate_id(true)</code> saves old <code>$_SESSION</code> variables,
  creates a new session and deletes the old one.</p>
  
  <p>My problem is that <code>$_SESSION</code> data is deleted by <code>session_regenerate_id(true)</code>, and the old session is not deleted (my session storage folder piles up session files after each call.
  And my <code>$_SESSION['xss_check']</code> variable is gone so my script fails and users can't login anymore.
  Now I'm not sure if I understand the use of <code>session_regenerate_id()</code> correctly or if i'm using it in the wrong place?</p>
  
  <p>I read through a lot of posts and I can't find a solutions other than just not using <code>session_regenerate_id()</code> but I want to to prevent session fixation.</p>
  
  <p>my code</p>
  
  <pre><code>    // start session; this runs at the top of every page as function to start or resume session  
      $cookieparams = session_get_cookie_params();
      $path = ini_get("session.save_path");
      $cookieparams['path'] = $path;
      session_set_cookie_params($lifetime, $cookieparams["path"], $cookieparams["domain"], false, true);
      setcookie('c_check', '1', 0);
      if  (session_start()) {
          if (isset($_COOKIE['c_check']) &amp;&amp; $_COOKIE['c_check'] === "1") {
              $_SESSION['COOKIES_ON'] = true;
          } else {
              $_SESSION['COOKIES_ON'] = false;
          }
      } else {
          // session failed to start
      }
  
  
      // the next code runs at the start of login_handler.php to regenerate session
      session_regenerate_id(true);
      if (!isset($_SESSION['LIFETIME'])) {
          $_SESSION['LIFETIME'] = time();
      } else if (time() - $_SESSION['LIFETIME'] &gt; 600) {
          session_regenerate_id(true);
          $_SESSION['LIFETIME'] = time();
      } else if (time() - $_SESSION['LIFETIME'] &gt; $lifetime) {
          session_unset();
          session_destroy();
          header('Location: http://localhost/session_expired.php');
          exit();
      }
  </code></pre>
  
  <p>I'm sure I'm doing something wrong.... I just don't know what!<br>
  Any input is appreciated and thanks in advance!!</p>