Securing Laravel Sessions with ID Regeneration

Session security is crucial for protecting user data. Laravel provides robust session management tools, including session ID regeneration capabilities. Let's examine how to implement this security feature effectively.

Understanding Laravel Session Regeneration

Session ID regeneration creates a new unique identifier for user sessions, preventing session fixation attacks. Laravel handles this automatically during authentication, but manual regeneration is sometimes necessary.

Let's implement secure session handling in a user settings management system:

<?php
 
namespace App\Http\Controllers;
 
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;
use App\Http\Requests\UpdateSettingsRequest;
 
class UserSettingsController extends Controller
{
    public function updateSecuritySettings(UpdateSettingsRequest $request)
    {
        $user = $request->user();
        // Update security settings
        $user->update([
            'password' => Hash::make($request->new_password),
            'two_factor_enabled' => $request->two_factor_enabled,
        ]);
 
        // Clear sessions on other devices
        Auth::logoutOtherDevices($request->current_password);
        // Regenerate session
        $request->session()->regenerate();
 
        return redirect()
            ->route('settings.security')
            ->with('status', 'Security settings updated successfully');
    }
 
    public function elevateSession(Request $request)
    {
        $request->validate([
            'password' => ['required', 'current_password']
        ]);
        // Set elevated session flag and regenerate
        $request->session()->put('elevated_access', true);
        $request->session()->regenerate();
 
        return redirect()->intended();
    }
 
    public function invalidateAllSessions(Request $request)
    {
        // Clear all session data and regenerate
        $request->session()->invalidate();
 
        return redirect()
            ->route('login')
            ->with('status', 'All sessions have been terminated');
    }
}