Cookies, how often should they be updated?

Question

HTTP Cookies

In general, I write a framework for learning purposes.
I will describe the implementation of authorization / registration, etc., which I have:
1) The user went to the site, he was given a cookie, if he does not have one either.
2) Further, if the user needs access to some functions that require registration, he drives an e-mail, registers it, the password flies to the email. The user is authorized for an hour.
3) An hour passes, you need to maintain a password .. (I plan to change it to user inactivity during the time set by him).
And now the question. The hash of the cookie does not change throughout the life of the user (yet). It's not safe in my opinion...
In general, there was an idea to change the hash cookies. Nothing prevents changing it with each user request: check if its hash is correct, if it is correct, change it to a new one. And on the next call, do the same, and so on.
With this option, interception of cookies is practically impossible, and the user will immediately notice ... that he is thrown out with a hash error. But is it worth it? There is a problem that the user will be able to work in parallel from only one device ... Well, or at most from different IP addresses. And if he comes from a mobile phone and from a computer from a home network ... then the algorithm becomes even more complicated.
Who would do what?
The point is to protect against unauthorized access.

Answer 1

The problem of multiple devices is solved by creating hashes for each device. Those. the cookie hash is not stored in a table with users, but in a separate table. One user can have multiple hashes. In the same place we add User-agent. IP can change even within the same provider with different connections, asking for a password in this situation is not at all logical. But if there is a question about exiting after an hour of inactivity, then you can add IP. The proposed method will allow you to change the hash with each request, if you wish.