I am working on a project where users can post. When a user logs in and the password is correct, it logs them in and checks the database. If they have a session id, it returns it, if not, it creates a new session id and returns it. If they log in again somewhere else such as their phone it does the same; if a session id exsits it returns the session.
My question is, is this secure? Should each device they log in with have a seperate session id? The only time I delete the session id is when the password is changed.