Revision history [back]

It is not possible to completely hide the PHP session ID from the client-side. However, there are some techniques that can make it harder for an attacker to exploit the session ID if they obtain it.

1. Session ID regeneration: By regenerating the session ID on every request or after a certain period of time, the session ID becomes less predictable and harder to guess. Use the following code to regenerate the session ID:

   session_regenerate_id(true);
   

2. Session ID storage in server-side only: You can store the session ID in the server-side only by disabling the session.usecookies and session.useonly_cookies configurations. This ensures that the session ID is not stored in the client-side as a cookie. Use the following code to disable these configurations:

   ini_set('session.use_cookies', 0);
   ini_set('session.use_only_cookies', 0);
   session_id($newSessionID); //Manually set the new session ID
   session_start();
   

3. SSL/TLS encryption: By using SSL/TLS encryption for your website, the session ID is encrypted between the client and server, making it harder for an attacker to intercept it. Use the following code to force SSL/TLS encryption for your website:

   if(!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] != 'on') {
      header('Location: https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);
      exit();
   }
   

Overall, by implementing these techniques, the PHP session ID can be made more secure and harder to exploit.