Why not have an identical session cookie for different user's devices?

Question

Here is my table structure:

// users
+----+--------+------------------------+------------------+-------------------------------+
| id |  name  |          email         |     cookie       |    /* some other columns */   |
+----+--------+------------------------+------------------+-------------------------------|
| 1  | Jack   | [email protected]   | ojer0f934mf2...  |                               |
| 2  | Peter  | [email protected]     | ko4398f43043...  |                               |
| 3  | John   | [email protected]   | 0243hfd348i4...  |                               |
+----+--------+------------------------+------------------+-------------------------------+

The cookie column contains a string (the cookie which keeps the user logged in) that is also set into user's devices. As you see, I have just one string (as the cookie) for each user. So all user's devices have an identical cookie.

Most professional programmers tell me:

It would be safer if each device had its own cookie (the cookie of each device should be different than the cookie of other devices, not a constant cookie for all devices)

Well, why? What's wrong with having an identical cookie for all devices? Also as you see I have just one record for the cookie in the database. So if I update that record for a new device, then the previous device(s) will be logged out.

EDIT: Imagine the following scenario (based on different cookies for different devices):

Alice logs in to my site on her computer at home, and stays logged in. Later she logs in on a computer at school as well, and dont sign out when she is done, but she forgets to sign out. She goes home and wants to sign out from her account at school. How can she do that?

Answer 1

The problem

Imagine the following scenario: Alice logs in to your site on her computer at home, and stays logged in. Later she logs in on a computer at school as well, but signs out when she is done. What happends when she gets home?

To make this system work, you would need to set the cookie column to NULL on logout. But that would log her out from all devices. That would be very annoying if you for instance want to stay continously logged in on your phone. So as long as you actually invalidate sessions server side on logout (you should always do that) this is more of a usability issue than a security issue.

Solution #1

So what would your table structure look like if you allowed multiple sessions per user? First, drop the cookie column from the users table. Then create a new table called sessions like this:

+------+------------------+
| user |     cookie       |
+------+------------------+
| 1    | ojer0f934mf2...  |
| 2    | ko4398f43043...  |
| 2    | 34fjkg3j438t...  |
| 3    | 0243hfd348i4...  |
+------+------------------+

Note that the second user has two different active session.

There should be a timestamp in there somewhere also, so that you can terminate the session after X hours. Even if you have a max-age on the cookie, you should always terminate sessions server side as well to mitigate the effects of session theaft.

Solution #2

No need to store session identifiers in a database. Just use PHP's built in session handling and you will not have to worry about generating ID's, setting cookies, etc.

Signing out from different devices

Conserning your edit about how to let Alice log out from school if she forgot to do it: Include a feature that lets her log out from all devices. Facebook, for instance, has a feature like that. Or if you don't want to waste energy implementing that, just instruct users to change their password - a well implemented password reset function should terminate all the users active sessions anyway.

In the database setup, ending all sessions would be the equivalent of running this:

DELETE FROM sessions WHERE user = :id

Answer 2

Cause it's easier to use a session hijacking attack...

More about it here https://www.owasp.org/index.php/Session_hijacking_attack