Don't delete session data when regenerating ids on login

[airbone42]

this would also remove the data of logged in user, so a login is actually not possible.

See the php manual for details on using session_regenerate_id: http://www.php.net/manual/en/function.session-regenerate-id.php

[verklov]

@airbone42, thank you for your contribution! We created ticket in the backlog and will get back to you once the team processes it.

[airbone42]

Actually this might be the fix for #449

[verklov]

@airbone42, the team has reviewed this issue. Below is the response from the developer:

The proposed session_regenerate_id(false) does not delete an old session. If we don't delete old session, then it leads to possible session hijacking because session_regenerate_id(false) leaves old, but still valid sessions inside the /tmp directory.

The description "this would also remove the data of logged in user, so a login is actually not possible." can be true ONLY in case with multiple requests, when they are put in queue:
Request 1(login): session_regenerate_id(true) changes session ID and deletes the old session(guest session).
Request 2: still has an old session ID(which doesn't exist) which leads to starting a new session.
Result: user is logged out.
So it doesn't make any sense to use session_regenerate_id(false), because we use session id regenerating only on login and the issue with multiple requests is not a case.

Unfortunately we do not accept this contribution and are closing this issue.

Nevertheless, thank you for the idea and please continue finding places that can be improved in Magento 2!