Description: ------------ Session ID should be unique for the session, so when many (2) users log in with the same credentials, they share the same session, that is a mess. Even with only one user the session variables are not expired when the session does, so the user got the same outdated session context when he logs in (if garbage collector did not run between sessions). As a worst case there should be a way to switch this behaviuor off instead of patching the code. Thank you, Ivan Gostev Reproduce code: --------------- In function assignData() line 88 should be commented out or removed: // session_id(md5("Auth_HTTP" . $this->username . $this->password));