Never more than 3 persons connected with the same login with Django

Question

Let's picture a django powered service that bills its customers monthly. The owner doesn't want his customers to share the account with people that did not pay. Of course, he understand that some may want to work collaboratively on an account, and don't want to restrain the use of shared accounts to the same IP address.

How would you let log in, with the same username / password, no more than 3 persons at the same times with django ?

I was thinking of implementing a counter in the User class but don't really know how good this idea is.

E.G :

Paul logs in using

Bonus question : what issues multi login can imply and what measures should I take to avoid conflicts between account users.

Answer 1

You could use cookies and store a GUID inside this cookie. If a user doesn't have a GUID, give him a new one. Otherwise, check the GUID in his cookie with the one in your database. If it's one of the three most recently assigned GUIDs then it's valid usage.

Example: User logs in, gets GUID A. Clears cookies. Logs in again, gets GUID B. Clears cookies. Logs in again, gets GUID C. Clears cookies again. Logs in again, gets GUID D. All valid. He could even log in again with an existing cookie containing the GUID B or C but if he visits with GUID A then he's probably sharing the account. (Or using four or more web browsers.)

Example 2: User 1 logs in, gets GUID A. User 2 logs in, gets GUID B. User 3 logs in, gets GUID C. User 4 logs in, gets GUID D. At this moment, GUID A would become invalid and you'd kick out user 1.

To do this, all you need is to keep track of the three most recent GUIDs that you assigned to the user, replacing the oldest one with a new GUID whenever the user has cleared his cookie. If you check this with every web request, you would effectively block every fourth (and more) user.