check if a users has already logged in?

Question

how do you check if a user already has logged in?

so that if a user in another browser cant log in with the same account.

also, is this a good solution or should i let the user log in in the other browser and then log out the current user and display a message (you are logged in from another location) just like messenger does?

Answer 1

Generate a random token upon signing in (or use the sessionid), and store this in the database and in the users cookie. With each page access, ensure that the users token matches the database entry. If the two don't match, alert the user that they've logged in elsewhere.

You could also store the login time, which subsequently would be the time the token was assigned, and require 30 minutes before permitting another user to login with the same ID.

Answer 2

Using sessions is a good way to do this, and is a very common method for controlling authentication.

The flow usually looks something like this:

• User visits site, and session_start() is called. A unique session identifier is set for that visitor (ie. a cookie).
• User submits his login credentials to a login form
• Login credentials are verified, and this fact is stored in the session data with $_SESSION['logged_in'] = true, or something similar
• For the rest of the user's time on the site, you can check $_SESSION['logged_in'] to see if the user has logged in.

In order to control a user's logins, you could simply have a field in a database (users table is fine) indicating what the current session id is (retrieved with session_id()) for the user, and if it doesn't match the cookie value you just received, then you immediately call session_destroy() for that id, and consider the user as logged out.

Using $_SESSION means you don't have to worry about generating your own tokens, and gives you the power of the built-in superglobals to facilitate storing information about the user's authentication status.

Personally, I would allow multiple sessions to be active for a user for most web sites, as there's usually not a good reason not to, but it obviously depends on the nature of the site. However, storing the current active session id as mentioned above is a pretty simple way to accomplish this.

Answer 3

Well All solutions mentioned above will work but if on every page access you are making a call to database and checking for the session token to see weather its the same token assigned to user .. will kill your response time. what i'll suggest is use a caching mechanism instead of database in above said solutions. storing session token into database will add extra field to your database which is actually not required. Use open source caching solution like memcache.

Answer 4

The first half of the question was answered well with how to detect the multiple users but how to treat them I think still needs a bit of work.

First if a user logs in correctly let them in, don't prevent them if they are logged on some other place. If you really don't want the user to have two open sessions then log out the old one or simply update the session id that you are saving so you can bounce out the old connection. You can inform if you want but I would only message the session that you invalidated. If you message the user logging in it becomes annoying when you are only dealing with the case of a user switching computers and they forgot to log out of the old session.