php 防止会员劫持,PHP中正确的会话劫持预防

我知道这个话题已经讨论 了很多 ，但是我还有一些具体问题仍未得到解答。例如：

// **PREVENTING SESSION HIJACKING**

// Prevents javascript XSS attacks aimed to steal the session ID

ini_set('session.cookie_httponly', 1);

// Adds entropy into the randomization of the session ID, as PHP's random number

// generator has some known flaws

ini_set('session.entropy_file', '/dev/urandom');

// Uses a strong hash

ini_set('session.hash_function', 'whirlpool');

// **PREVENTING SESSION FIXATION**

// Session ID cannot be passed through URLs

ini_set('session.use_only_cookies', 1);

// Uses a secure connection (HTTPS) if possible

ini_set('session.cookie_secure', 1);

session_start();

// If the user is already logged

if (isset($_SESSION['uid'])) {

// If the IP or the navigator doesn't match with the one stored in the session

// there's probably a session hijacking going on

if ($_SESSION['ip'] !== getIp() || $_SESSION['user_agent_id'] !== getUserAgentId()) {

// Then it destroys the session

session_unset();

session_destroy();

// Creates a new one

session_regenerate_id(true); // Prevent's session fixation

session_id(sha1(uniqid(microtime())); // Sets a random ID for the session

}

} else {

session_regenerate_id(true); // Prevent's session fixation

session_id(sha1(uniqid(microtime())); // Sets a random ID for the session

// Set the default values for the session

setSessionDefaults();

$_SESSION['ip'] = getIp(); // Saves the user's IP

$_SESSION['user_agent_id'] = getUserAgentId(); // Saves the user's navigator

}

所以，我的问题是

做ini_set的提供足够的安全性？

可以保存用户的IP和导航器，然后在每次加载页面时进行检查以检测会话劫持吗？这有什么问题吗？

使用session_regenerate_id()正确吗？

使用session_id()正确吗？