Session protection from theft?

Question

PHP

Dear users, tell me how you can protect the session from theft (substitution) as much as possible?
At the moment I use:
1. Encryption of the SHA512 session
2. Binding to the md5 hash of the IP + USER_AGENT bundle, and each time I check for compliance.
3. Dynamic session identifier. With each request to the server, a new session is created while retaining the data from the previous one. Thus, even if an attacker steals cookies, changes IP and USER_AGENT, then there is a chance that he will not have time to log in. Provided that after the theft of the session, the user made at least one request.
What else can be added or vice versa removed? Thanks in advance! :)

Answer 1

ssl
httponly cookie
https://en.wikipedia.org/wiki/Session_hijacking#Pr...

Answer 2

Usually cookies store a session ID with a key like PHPSESSID
But you can make the cookie name itself less predictable, for example md5(service-id)

Answer 3

https - connection
And here IP + USER_AGENT, you create a problem for users from cellular networks, since their IP address can change.
Encrypting the session key is meaningless, because it's just data that can be copied.
A dynamic token will help detect concurrent work, but will not protect against hijacking by 100%