Regenerate session ID after successful authentication

Closes #5141
2023-04-10 21:36:31 -07:00 · 2023-04-10 21:36:31 -07:00 · ae7bc0b74d
parent 4adb93c1a6
commit ae7bc0b74d
1 changed files with 4 additions and 0 deletions
--- a/app/Core/User/UserSession.php
+++ b/app/Core/User/UserSession.php
@ -44,6 +44,10 @@ class UserSession extends Base
        $user['is_ldap_user'] = isset($user['is_ldap_user']) ? (bool) $user['is_ldap_user'] : false;
        $user['twofactor_activated'] = isset($user['twofactor_activated']) ? (bool) $user['twofactor_activated'] : false;

+        if (session_status() === PHP_SESSION_ACTIVE) {
+            session_regenerate_id(true);
+        }
+
        session_set('user', $user);
        session_set('postAuthenticationValidated', false);
    }