Whether you want to allow or disallow concurrent logins will very much come down to the threat model of your application. Typically I'd say that for higher risk applications (e.g. online banking or anything else transactional) its likely to be warranted.

In terms of the security benefit, the main one is that disallowing concurrent logins can reduce the risk of a session hijacking attack being able to persist for a long time.

So for example, if an attacker is able to steal a session token, if you disallow concurrent logins it would be invalidated when the user logged back in.

Another possible benefit is if a user leaves themselves logged in on a shared PC, invalidating that session the next time they login reduces the risk of another user of that PC gaining access to their session.

The trade-off is that users don't like being asked to re-authenticate a lot, especially if that is a high-friction process.

Whether you want to allow or disallow concurrent logins will very much come down to the threat model of your application. Typically I'd say that for higher risk applications (e.g. online banking or anything else transactional) disallowing concurrent logins is likely to be warranted.

In terms of the security benefit, the main one is that disallowing concurrent logins can reduce the risk of a session hijacking attack being able to persist for a long time.

So for example, if an attacker is able to steal a session token, if you disallow concurrent logins it would be invalidated when the user logged back in.

Another possible benefit is if a user leaves themselves logged in on a shared PC, invalidating that session the next time they login reduces the risk of another user of that PC gaining access to their session.

The trade-off is that users don't like being asked to re-authenticate a lot, especially if that is a high-friction process.