The session cookie can be tampered with

[msachi]

You don't seem to be using jwts or any other way of signing the user information in the cookie. This means that anyone can change the username part in their cookie and get logged in as an arbitrary user.