The question is related to session-ID management in a particular php-based web-app.
The web-app uses the same session-ID for each session for a fixed user. So, after logging-out of the application, next time the user is logged in, the same session-ID is released as a cookie. However, while the user is not logged in, the application disallows using the cookie (resending the HTTP requests with the same cookie are forwarded to login page).
Is this considered a bad security practice? How about if the same session-ID is used for all users?