src/SessionHandler.php
private function handleStrict(): void
    {
        if (!ini_get('session.use_strict_mode') || headers_sent()) {
            return;
        }

        $cookieName = session_name();
        if (empty($_COOKIE[$cookieName])) {
            return;
        }

        $sessionId = $_COOKIE[$cookieName];

        $identifier = $this->cryptProvider->makeSessionIdentifier($sessionId);

        if ($this->storageDriver->sessionExists($identifier)) {
            return;
        }

        $newSessionId = session_create_id();
        session_id($newSessionId);
    }
private function handleStrict(): void
    {
        if (!ini_get('session.use_strict_mode') || headers_sent()) {
            return;
        }

        $cookieName = session_name();
        if (empty($_COOKIE[$cookieName])) {
            return;
        }

        $sessionId = $_COOKIE[$cookieName];

        $identifier = $this->cryptProvider->makeSessionIdentifier($sessionId);

        if ($this->storageDriver->sessionExists($identifier)) {
            return;
        }

        $newSessionId = session_create_id();
        session_id($newSessionId);
    }
private function handleStrict ( ) : void { if ( ! ini_get ( 'session.use_strict_mode' ) || headers_sent ( ) ) { return ; } $ cookieName = session_name ( ) ; if ( empty ( $ _COOKIE [ $ cookieName ] ) ) { return ; } $ sessionId = $ _COOKIE [ $ cookieName ] ; $ identifier = $ this -> cryptProvider -> makeSessionIdentifier ( $ sessionId ) ; if ( $ this -> storageDriver -> sessionExists ( $ identifier ) ) { return ; } $ newSessionId = session_create_id ( ) ; session_id ( $ newSessionId ) ; }
Rejects arbitrary session ids.

@SuppressWarnings(PHPMD.Superglobals)

@see    http://php.net/manual/en/features.session.security.management.php#features.session.security.management.non-adaptive-session Why this security measure is important.
@return void
Rejects arbitrary session ids .