Question about session_id() and session_start()

Question

I find the Note in PHP document. http://www.php.net/manual/en/function.session-id.php

"Note: When using session cookies, specifying an id for session_id() will always send a new cookie when session_start() is called, regardless if the current session id is identical to the one being set."

I feel puzzled about this feature. Even if the current session id is identical to the one one being set, session_start will send a new cookie. I want to know why session_start behave in this way.

Answer 1

You will find the answer in the PHP source code. If you don't want this to happen, check if the current session id matches with the value you want to set it to, and don't set if they match.

Comments

There are well over half a million lines of source code in PHP. It seems a little unhelpful to tell someone to go and read half a million lines of C when you could just tell them the answer?

Answer 2

I guess it would be to help prevent session hijacks like explained here
http://stackoverflow.com/questions/12233406/preventing-session-hijacking