The problem

Imagine the following scenario: Alice logs in to your site on her computer at home, and stays logged in. Later she logs in on a computer at school as well, but signs out when she is done. What happends when she gets home?

To make this system work, you would need to set the cookie column to NULL on logout. But that would log her out from all devices. That would be very annoying if you for instance want to stay continously logged in on your phone. So as long as you actually invalidate sessions server side on logout (you should always do that) this is more of a usability issue than a security issue.

Solution #1

So what would your table structure look like if you allowed multiple sessions per user? First, drop the cookie column from the users table. Then create a new table called sessions like this:

+------+------------------+
| user |     cookie       |
+------+------------------+
| 1    | ojer0f934mf2...  |
| 2    | ko4398f43043...  |
| 2    | 34fjkg3j438t...  |
| 3    | 0243hfd348i4...  |
+------+------------------+

Note that the second user has two different active session.

Solution #2

No need to store session identifiers in a database. Just use PHP's built in session handling and you will not have to worry about generating ID's, setting cookies, etc.

Signing out from different devices

Conserning your edit about how to let Alice log out from school if she forgot to do it: Include a feature that lets her log out from all devices. Facebook, for instance, has a feature like that. Or if you don't want to waste energy implementing that, just instruct users to change their password - a well implemented password reset function should terminate all the users active sessions anyway.

In the database setup, ending all sessions would be the equivalent of running this:

DELETE FROM sessions WHERE user = :id

The problem

Imagine the following scenario: Alice logs in to your site on her computer at home, and stays logged in. Later she logs in on a computer at school as well, but signs out when she is done. What happends when she gets home?

To make this system work, you would need to set the cookie column to NULL on logout. But that would log her out from all devices. That would be very annoying if you for instance want to stay continously logged in on your phone. So as long as you actually invalidate sessions server side on logout (you should always do that) this is more of a usability issue than a security issue.

Solution #1

So what would your table structure look like if you allowed multiple sessions per user? First, drop the cookie column from the users table. Then create a new table called sessions like this:

+------+------------------+
| user |     cookie       |
+------+------------------+
| 1    | ojer0f934mf2...  |
| 2    | ko4398f43043...  |
| 2    | 34fjkg3j438t...  |
| 3    | 0243hfd348i4...  |
+------+------------------+

Note that the second user has two different active session.

There should be a timestamp in there somewhere also, so that you can terminate the session after X hours. Even if you have a max-age on the cookie, you should always terminate sessions server side as well to mitigate the effects of session theaft.

Solution #2

No need to store session identifiers in a database. Just use PHP's built in session handling and you will not have to worry about generating ID's, setting cookies, etc.

Signing out from different devices

Conserning your edit about how to let Alice log out from school if she forgot to do it: Include a feature that lets her log out from all devices. Facebook, for instance, has a feature like that. Or if you don't want to waste energy implementing that, just instruct users to change their password - a well implemented password reset function should terminate all the users active sessions anyway.

In the database setup, ending all sessions would be the equivalent of running this:

DELETE FROM sessions WHERE user = :id

The problem

Imagine the following scenario: Alice logs in to your site on her computer at home, and stays logged in. Later she logs in on a computer at school as well, but signs out when she is done. What happends when she gets home?

To make this system work, you would need to set the cookie column to NULL on logout. But that would log her out from all devices. That would be very annoying if you for instance want to stay continously logged in on your phone. So as long as you actually invalidate sessions server side on logout (you should always do that) this is more of a usability issue than a security issue.

Solution #1

So what would your table structure look like if you allowed multiple sessions per user? First, drop the cookie column from the users table. Then create a new table called sessions like this:

+------+------------------+
| user |     cookie       |
+------+------------------+
| 1    | ojer0f934mf2...  |
| 2    | ko4398f43043...  |
| 2    | 34fjkg3j438t...  |
| 3    | 0243hfd348i4...  |
+------+------------------+

Note that the second user has two different active session.

Solution #2

No need to store session identifiers in a database. Just use PHP's built in session handling and you will not have to worry about generating ID's, setting cookies, etc.

Signing out from different devices

Conserning your edit about how to let Alice log out from school if she forgot to do it: Include a feature that lets her log out from all devices. Facebook, for instance, has a feature like this. Or if you don't want to waste energy implementing that, just instruct users to change their password - a well implemented password reset function should terminate all the users active sessions anyway.

In the database setup, ending all sessions would be the equivalent of running this:

DELETE FROM sessions WHERE user = :id

The problem

Imagine the following scenario: Alice logs in to your site on her computer at home, and stays logged in. Later she logs in on a computer at school as well, but signs out when she is done. What happends when she gets home?

To make this system work, you would need to set the cookie column to NULL on logout. But that would log her out from all devices. That would be very annoying if you for instance want to stay continously logged in on your phone. So as long as you actually invalidate sessions server side on logout (you should always do that) this is more of a usability issue than a security issue.

Solution #1

So what would your table structure look like if you allowed multiple sessions per user? First, drop the cookie column from the users table. Then create a new table called sessions like this:

+------+------------------+
| user |     cookie       |
+------+------------------+
| 1    | ojer0f934mf2...  |
| 2    | ko4398f43043...  |
| 2    | 34fjkg3j438t...  |
| 3    | 0243hfd348i4...  |
+------+------------------+

Note that the second user has two different active session.

Solution #2

No need to store session identifiers in a database. Just use PHP's built in session handling and you will not have to worry about generating ID's, setting cookies, etc.

Signing out from different devices

Conserning your edit about how to let Alice log out from school if she forgot to do it: Include a feature that lets her log out from all devices. Facebook, for instance, has a feature like that. Or if you don't want to waste energy implementing that, just instruct users to change their password - a well implemented password reset function should terminate all the users active sessions anyway.

In the database setup, ending all sessions would be the equivalent of running this:

DELETE FROM sessions WHERE user = :id

The problem

Imagine the following scenario: Alice logs in to your site on her computer at home, and stays logged in. Later she logs in on a computer at school as well, but signs out when she is done. What happends when she gets home?

To make this system work, you would need to set the cookie column to NULL on logout. But that would log her out from all devices. That would be very annoying if you for instance want to stay continously logged in on your phone. So as long as you actually invalidate sessions server side on logout (you should always do that) this is more of a usability issue than a security issue.

Solution #1

So what would your table structure look like if you allowed multiple sessions per user? First, drop the cookie column from the users table. Then create a new table called sessions like this:

+------+------------------+
| user |     cookie       |
+------+------------------+
| 1    | ojer0f934mf2...  |
| 2    | ko4398f43043...  |
| 2    | 34fjkg3j438t...  |
| 3    | 0243hfd348i4...  |
+------+------------------+

Note that the second user has two different active session.

Solution #2

No need to store session identifiers in a database. Just use PHP's built in session handling and you will not have to worry about generating ID's, setting cookies, etc.

The problem

Imagine the following scenario: Alice logs in to your site on her computer at home, and stays logged in. Later she logs in on a computer at school as well, but signs out when she is done. What happends when she gets home?

To make this system work, you would need to set the cookie column to NULL on logout. But that would log her out from all devices. That would be very annoying if you for instance want to stay continously logged in on your phone. So as long as you actually invalidate sessions server side on logout (you should always do that) this is more of a usability issue than a security issue.

Solution #1

So what would your table structure look like if you allowed multiple sessions per user? First, drop the cookie column from the users table. Then create a new table called sessions like this:

+------+------------------+
| user |     cookie       |
+------+------------------+
| 1    | ojer0f934mf2...  |
| 2    | ko4398f43043...  |
| 2    | 34fjkg3j438t...  |
| 3    | 0243hfd348i4...  |
+------+------------------+

Note that the second user has two different active session.

Solution #2

No need to store session identifiers in a database. Just use PHP's built in session handling and you will not have to worry about generating ID's, setting cookies, etc.

Signing out from different devices

Conserning your edit about how to let Alice log out from school if she forgot to do it: Include a feature that lets her log out from all devices. Facebook, for instance, has a feature like this. Or if you don't want to waste energy implementing that, just instruct users to change their password - a well implemented password reset function should terminate all the users active sessions anyway.

In the database setup, ending all sessions would be the equivalent of running this:

DELETE FROM sessions WHERE user = :id