How to ensure the same account is not used to log in two different people at the same time in Spring Security?

Question

I have a Spring MVC app that does not protect updates of user data with transactions.

It assumes that only a single user is accessing the account data for that account at any one time.

However, if two users were to log in using the same authentication credentials, it is theoretically possible, although unlikely, for two database updates on the same user data to overlap and conflict.

Is there a simple way to protect against this in Spring Security?

Answer 1

Add a column to the user database called "logged in". If that value is set, then refuse a second login.

Answer 2

Spring Security supports protection against concurrent logins. See 2.3.3 Session Management for instructions of how to enable it.

Answer 3

The answer from Aaron Digulla is the best one. The suggestion from BalusC is not good because if someone steals your login credentials then he can gain access to the system and the legitimate user will be logged out. If that person is meant for evil then he can change the password and the legitimate user can't access his/her account anymore.

The best way is what Aaron suggested.