I'm currently developing a secure system utilizing PHP session cookies, and rather than trying to deal with recreating a session every time the script runs (which would hurt server performance), I'm having the script send a 2nd cookie to the client which contains an MD5 of their username along with a random value (so that it's harder to generate a matching key if somebody is trying to hijack the session.) The original random value can be stored as $_SESSION['rndvalue'] or something of the like, and easily re-hashed and compared to the cookie. If it isn't valid, just a simple session_destroy(); does the trick. For higher security, the random value could even be changed at every new page, and to make leeway for that double-click phenomon, save the old one as 'rndvalueold' with the expiration time as 'rndvalueexpire' or something. This will also let users use the back button even if the session ID is passed via GET or POST.
Load balance : Server 05
