Symphony.

Perhaps. But we’re discussing non-essential cookie/session issues here.

Regenerating session id’s is not really a must anyway.

The only reason to do it is to prevent people to “guess” session id’s. (or to obtain them using a xss hack). If this is the goal, you can’t refresh often enough.

However, there are far better methods of preventing those hacks, although most will ahve other drawbacks.

The cookie expiration date is never updated whether you log in or not. At least that is true on my installation (2.1.0)

@wisolman, so you’re saying that you login once, the cookie is created with a future date of 2 weeks. then you logout, then say a few days later, you log back in and the cookie still has the date set to expire from the previously logged in session?

@wtdtan - That has been my experience. You can check it out on your installation by looking at the PHPSESSID cookie on your computer. Note the expiration date, perform a logout/login process on your site and then recheck the cookie expiration date. I think you will find that it hasn’t changed.