In addition to completely destroying the session and we log out we can also increase the security of
the log in process.
By using sessions to remember they are indications status of a user.
In other words if that use is logged in or not we've opened up our site to what's known as a session
fixation attack.
Basically this allows an attacker to steal the session of a logged in user.
If our site is vulnerable to cross-site scripting as we saw earlier.
So if we forgotten to use the h.t. EMAIL special Charles function somewhere we could be vulnerable.
You can read more about how this attack works in full detail here on this web page.
We can help to prevent an attack like this by changing the session eidy after the user has logged in.
For that we use the session regenerate idea function.
So here in the luggin script as soon as the user has authenticated successfully we call this function
to generate a new session idae passing in.
True as the argument deletes the old session when we do this.
The session idea is changed to a new one but any session data is maintained.
So now when we log in.
It works as before we don't notice anything but the session I.D. has been regenerated helping to prevent
sessions fixation attacks.