I am working on a project where users have accounts and log in using their username and password if they are correct the code returns a session id. Next time they open the app or visit the site it gets the stored session and sends it to the database and returns the user's data.
My problems are what if someone finds a way to enter fake session id's and then visit my site and if they keep trying they are bound to get a valid session.
In the app's user data and webpage cookies besides storing the session token should I also store something such as their user ID? Then when they visit the site I get both the session and user ID to check if they match making it way harder for someone to just type random sessions since they have to find a session and correct user id (which is 120 characters long).