If your server is compromised you tend to have bigger problems than session forgery. Why would an attacker bother to fabricate http-sessions after he already ga

If your server is compromised you tend to have bigger problems than session forgery. Why would an attacker bother to fabricate http-sessions after he already gained access to your database and, in most cases, source-code? Replay-attacks work the exact same whether you use this scheme or store a magic number server-side. There's no difference whatsoever. For a password-change you update the last_logout timestamp and hand the user a new cookie (since his current one was just invalidated).