Authentication::checkSessionSecurity

static function checkSessionSecurity(CurrentUser $user)
{
	$context = BitrixMainApplication::getInstance()->getContext();
	if (!($context instanceof BitrixMainHttpContext))
		throw new BitrixMainNotSupportedException();

	$policy = $user->getPolicy();
	$currentTime = time();

	/** @var $request BitrixMainHttpRequest */
	$request = $context->getRequest();
	$remoteAddress = $request->getRemoteAddress();

	// IP address changed
	$destroySession = $_SESSION['SESS_IP']
		&& strlen($policy["SESSION_IP_MASK"]) > 0
		&& (
			(ip2long($policy["SESSION_IP_MASK"]) & ip2long($_SESSION['SESS_IP']))
			!=
			(ip2long($policy["SESSION_IP_MASK"]) & ip2long($remoteAddress))
		);

	// session timeout
	if (!$destroySession)
		$destroySession = $policy["SESSION_TIMEOUT"] > 0
			&& $_SESSION['SESS_TIME'] > 0
			&& $currentTime - $policy["SESSION_TIMEOUT"] * 60 > $_SESSION['SESS_TIME'];

	// session expander control
	if (!$destroySession)
		$destroySession = $_SESSION["BX_SESSION_TERMINATE_TIME"] > 0
			&& $currentTime > $_SESSION["BX_SESSION_TERMINATE_TIME"];

	if ($destroySession)
	{
		$_SESSION = array();
		@session_destroy();

		//session_destroy cleans user session handles in some PHP versions
		//see http://bugs.php.net/bug.php?id=32330 discussion
		if (
			ConfigOption::get("security", "session", "N") === "Y"
			&& MainLoader::includeModule("security"))
		{
			CSecuritySession::init();
		}

		session_id(md5(uniqid(rand(), true)));
		session_start();
	}
	$_SESSION['SESS_IP'] = $remoteAddress;
	$_SESSION['SESS_TIME'] = time();

	//session control from security module
	if (
		(ConfigOption::get("main", "use_session_id_ttl", "N") == "Y")
		&& (intval(ConfigOption::get("main", "session_id_ttl", 0)) > 0)
		&& !defined("BX_SESSION_ID_CHANGE")
	)
	{
		if (!array_key_exists('SESS_ID_TIME', $_SESSION))
		{
			$_SESSION['SESS_ID_TIME'] = $_SESSION['SESS_TIME'];
		}
		elseif (($_SESSION['SESS_ID_TIME'] + intval(ConfigOption::get("main", "session_id_ttl"))) < $_SESSION['SESS_TIME'])
		{
			if (ConfigOption::get("security", "session", "N") === "Y"
				&& BitrixMainLoader::includeModule("security"))
			{
				CSecuritySession::updateSessID();
			}
			else
			{
				session_regenerate_id();
			}
			$_SESSION['SESS_ID_TIME'] = $_SESSION['SESS_TIME'];
		}
	}

	return !$destroySession;
}