title: Securely creating and destroying login sessions in PHP
body: <p>This is my code to control authentication on a website. I'm not sure if my logic is correct. If the username and password are correct the following happen:</p>
  
  <pre><code>if(session_start())
  {
          session_regenerate_id(true);//without this the session ID will always be the same
          $_SESSION['loggedInUser'] = $uName;
          echo 'You are now logged in';
  }
  else echo 'Right password/username but session failed to start';
  </code></pre>
  
  <p>Subsequent pages check to see if the user is logged in by</p>
  
  <pre><code>session_start();
  if(isset($_SESSION['loggedInUser'])
  {
   //rest of page
  }
  else echo 'you must log in';
  </code></pre>
  
  <p>When logging out I have</p>
  
  <pre><code>session_start();//if I don't have this the next line produces an error
  session_unset();//destroys session variables
  session_destroy();//ends session
  </code></pre>
  
  <p>I red not to call session_start() on logout but if I don't have it there I get the message <code>Trying to destroy uninitialized session</code>. How can I fix this?</p>
  
  <p>Is it recommend or not to create a finger print based on the IP address and user agent? I red it's bad because multiple computers can share the same IP address if they are in, for example a computer lab, and all the traffic goes through a proxy and the same computer could change it's IP address if it's dynamic. On the other hand, how often does this happen? It may be worth the few blocked valid uses to prevent all session hijacking.</p>
  
  <p>Even if you could recommend reputable articles I should read to learn about this topic that would be great, thanks.</p>
  
  <p>5/6 answers have votes less than 0 :( Could down voters comment so I know what to look out for?</p>