Can I use encrypted cookies to store sessions?

Question

Computer networks

There is an idea to use encrypted signed (HMAC) Cookies to store the user session on the client side. There is a security issue where an attacker, knowing the key, can create a Cookie for any user. But this problem can be circumvented if, together with the user id, a part of the user's password hash is stored in the Cookie. Thus, the maximum that an attacker can do is to hack one user.
What could be the disadvantages of this method?

Answer 1

0_o
your id cookies are not random, but by key? this is a vulnerability, yes...
If the session data is stored, then the loss of the key is a vulnerability in itself, the rest are a consequence.