Session tokens need to be stored on the server (redis, db, etc..) so you can change them, see all devices logged in, and other requests product will have. They

Session tokens need to be stored on the server (redis, db, etc..) so you can change them, see all devices logged in, and other requests product will have. They should be unguessable and unrelated to anything. Read 20 bytes from /dev/urandom (or whatever stdlib your language provides), create an entry in your store for token->user_id, then put it in a httpOnly + secure cookie (so Javascript can't access it), and send it to the client.