title: How does session_regenerate_id() work internally?
body: <p>I am trying to secure sessions for users on a website.
  On the login flow, I am regenerating session id, to ensure better security (reduce chances of guessing) in terms of session fixation. I was trying to test a script for the working of session_regenerate_id(). There are two instances of it. They are:<br>
  <strong>1) Delete old session by using session_regenerate_id(true)</strong></p>
  
  <pre><code>&lt;?php
  session_start();
  if (!isset($_SESSION['times'])) {
      $_SESSION['times'] = 0;
      $_SESSION['generate'] = true;
  } else {
      if ($_SESSION['generate'] === true) {
          session_regenerate_id(true);
          $_SESSION['generate'] = false;
      }
      $_SESSION['times']++;
  }
  var_dump($_SESSION['times']);
  var_dump(session_id());
  ?&gt;
  </code></pre>
  
  <p>The following is the output I got for it:</p>
  
  <pre><code>/var/www/public/goto/index.php:31:int 0
  /var/www/public/goto/index.php:32:string 'q96btv7i1ukpb3cq8tskcgdeb7' (length=26)
  </code></pre>
  
  <p>On another tab (same browser):</p>
  
  <pre>/var/www/public/goto/index.php:31:int 1
  /var/www/public/goto/index.php:32:string 'gspq91o1jbcrcc27b4fkm4qgd5' (length=26)</pre>
  
  <p>On checking the folder after opening the same page in another tab where, session files are stored, I found the session file associated only with the string: <strong>gspq91o1jbcrcc27b4fkm4qgd5</strong></p>
  
  <p>2) <strong>Just regenerated new session id by using session_regenerate_id()</strong></p>
  
  <pre><code>&lt;?php
  session_start();
  if (!isset($_SESSION['times'])) {
      $_SESSION['times'] = 0;
      $_SESSION['generate'] = true;
  } else {
      if ($_SESSION['generate'] === true) {
          session_regenerate_id();
          $_SESSION['generate'] = false;
      }
      $_SESSION['times']++;
  }
  var_dump($_SESSION['times']);
  var_dump(session_id());
  ?&gt;
  </code></pre>
  
  <p>Output for first tab:</p>
  
  <pre><code>/var/www/public/goto/index.php:31:int 0
  /var/www/public/goto/index.php:32:string 'odu7sttll7pp43suqu22laa755' (length=26)
  </code></pre>
  
  <p>Output on second tab:</p>
  
  <pre><code>/var/www/public/goto/index.php:31:int 1
  /var/www/public/goto/index.php:32:string '27po8j6bu318fd3e69ug4m53i3' (length=26)
  </code></pre>
  
  <p>In this case, I found session files for both the session ids:<strong>odu7sttll7pp43suqu22laa755</strong> and <strong>27po8j6bu318fd3e69ug4m53i3</strong>
  Thus, what the function says, it does.
  But, my question comes here (sorry for the long intro), in the first case, when using <code>session_regenerate_id(true)</code>, the cookie on the first tab contained the old session id, whereas the one on the new tab, contained the new session id.
  After opening the second tab, when I refresh the first one, I magically get <code>3</code> as output and the <code>session id</code> of the second tab. 
  What I don't understand here is when I refresh <code>Tab 1</code>, the cookie it sends to the server contains the old session id, which shouldn't be no longer valid (and also doesn't exist as file on the server), <strong>how do I get <code>3</code> as output?<br>How is the same session persisted, even when Tab 1 has no idea about the regeneration and the new session cookie?<br>Shouldn't the request when I refresh the page on Tab 1 <strong>not</strong> get me the newly generated session (on Tab 2)?<br>That would be having two sessions on the same browser, which is not what actually happens. How does PHP handle this on <code>session_regenerate_id(true)</code></strong></p>
  
  <p>Please note: The following is my output for session from phpinfo()
  <a href="https://i.stack.imgur.com/pxeb8.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/pxeb8.png" alt="php config"></a></p>