I read about many old questions about this argument, and I thought that the best practice is to set up a cookie with `username`,`user_id` and a random token.

Same cookie's data is stored in DB at cookie creation, and when users have the cookie they are compared (cookie data, DB data).

Sincerely I can't understand where is the security logic if this is the real best practice.

An attacker who steals the cookie has the same cookie than the original user :| 

Forgotten some step? :P