Imagine the following scenario: Alice logs in to your site on her computer at home, and stays logged in. Later she logs in on a computer at school as well, but signs out when she is done. What happends when she gets home? To make this system work, you would need to set the `cookie` column to `NULL` on logout. But that would log her out from all devices. That would be very annoying if you for instance want to stay continously logged in on your phone. So as long as you actually invalidate sessions server side on logout (you should always do that) this is more of a usability issue than a security issue. So what would your table structure look like if you allowed multiple sessions per user? First, drop the `cookie` column from the `users` table. Then create a new table called `sessions` like this: +------+------------------+ | user | cookie | +------+------------------+ | 1 | ojer0f934mf2... | | 2 | ko4398f43043... | | 2 | 34fjkg3j438t... | | 3 | 0243hfd348i4... | +------+------------------+ Note that the second user has two different active session.