Handling multiple single-user logins in PHP

Question

I recently simulated multiple login in PHP using 1 account. Here's what I did

1. opened 2 login screens
2. logged into account 1 using the first login screen
3. login successful
4. logged into account 2 using the second login screen

What I want to do is to logout user 1 when user 2 logs in on the same machine and the same browser.

How do I do that? I also did this with Gmail and if email 1 is logged in and email 2 logs in, Gmail displays an alert box saying that user 1 is logged out (assuming that I log in using the same machine and in the same browser).

Answer 1

If you are saving sessions (which you should if there's any persisting data involved) just check if the other user session exists and delete it.

UPDATE:

I don't think that's the Gmail approach, at least it's not working the same for me. I can open up 2 Gmail login tabs (same browser, same session as stated) and authenticate in both of them without problems. Certainly both connections appear in Gmail's account activity, but it's not seen as malicious activity, you will only be kicked out if you're on a different computer.

You can't really distinguish between users using the same browser and the same session, just because you're not using a persistent connection, that's the nature of the web.

You need something to distinguish between them: date, browser session, ip, anything. It seems that the only choice you have is using a timestamp when any of them logged in, but that's pretty tricky and i don't recommend it.

I will suggest USER 1 to smack USER 2 if he's trying to use the same login on the same browser (ok, bad joke).

Answer 2

If you set the same cookie for all users, you can use javascript to periodically check that the username/data associated with that cookie is the same one as originally logged into the page.

If you see a change, pop up the notice and navigate away from the page.

Additionally, if you absolutely have to validate this, you might send the intended user with each post/get request, in addition to the cookie, then validate that the cookie matches that user. This causes other kinds of problems though, so it's probably overkill.