Does this library protect against session fixation attacks?

[xiaojunlu]

Does this library protect against session fixation attacks?

[jasny]

Partly

I'm assuming that your auth lib takes care of generating a new session on login. As you state, you're already doing that. Do make sure that the session data is deleted (either manually or by session_regenerate_id).

Brokers might still try to use the old session since that cookie isn't invalidated on logout, which isn't allowed. The GlobalSession handler prevents a broker from resuming a deleted session. See line 69-72

On the broker side you might want to gracefully catch this error and reattach with a new token. This isn't done in the demo.