Recommended way for versions of PHP >= 5.4.0 , PHP 7, PHP 8 if (session_status() === PHP_SESSION_NONE) { session_start(); } Reference: http://www.php.net/manual/en/function.session-status.php For versions of PHP < 5.4.0 if(session_id() == ”) { session_start(); }
First of all, REST is not a religion and should not be approached as such. While there are advantages to RESTful services, you should only follow the tenets of REST as far as they make sense for your application. That said, authentication and client side state do not violate REST principles. While REST requires that … Read more
I too have been researching this question, and while none of the ideas below are complete solutions, they might help others rule out ideas, or provide further ones. 1) Simply remove the token from the client Obviously this does nothing for server side security, but it does stop an attacker by removing the token from … Read more
You should implement a session timeout of your own. Both options mentioned by others (session.gc_maxlifetime and session.cookie_lifetime) are not reliable. I’ll explain the reasons for that. First: session.gc_maxlifetime session.gc_maxlifetime specifies the number of seconds after which data will be seen as ‘garbage’ and cleaned up. Garbage collection occurs during session start. But the garbage collector … Read more