Use session_regenerate_id() to prevent fixation attacks

Author: mevdschee

src/Tqdev/PhpCrudApi/Middleware/BasicAuthMiddleware.php

@@ -90,6 +90,7 @@ public function handle(Request $request): Response
             if (!$validUser) {
                 return $this->responder->error(ErrorCode::AUTHENTICATION_FAILED, $username);
             }
+            session_regenerate_id();
         }
         if (!isset($_SESSION['username']) || !$_SESSION['username']) {
             $authenticationMode = $this->getProperty('mode', 'required');

src/Tqdev/PhpCrudApi/Middleware/JwtAuthMiddleware.php

@@ -107,6 +107,7 @@ public function handle(Request $request): Response
             if (empty($claims)) {
                 return $this->responder->error(ErrorCode::AUTHENTICATION_FAILED, 'JWT');
             }
+            session_regenerate_id();
         }
         if (empty($_SESSION['claims'])) {
             $authenticationMode = $this->getProperty('mode', 'required');