How to allow a user to only login once.

[reedallenbrown]

How can I force a user to log out before logging in again? I do not want them to be able to log in and then open another browser and log in again at the same time.

Any idea's?

Thanks

[Keith Hubert]

Re: How to allow a user to only login once.

How about a field that is set to active when they log in, which gets looked at each time the login is done. If it is true then the second login cant be done.

[madtowng]

Re: How to allow a user to only login once.

I haven't tried this yet, but knowing that users often forget, or don't have the chance to logout gracefully,
that you should be able to check for a session that does not have a logout time, force that session to end,
and then continue with the user's new session.

[Steve Wood]

Re: How to allow a user to only login once.

You can't force them to log out because they can just walk away or close the browser. You can do what Keith said, but what are you going to do when they come back and that box is still checked? You can't tell them to go back to the "other" browser and properly log out because they probably already closed that browser, plus you can't really tell if they are coming back using the previous browser unless you save a cookie to their computer when they initially logged in. Until they login, you don't know who they are anyway.

---

So, to ensure the same account does not login from two machines at the same time, try this (haven't tried it, just thought of it):

You need to have a "users" table for this to work.

When they login, save their session.sessionid to their Users table (looks like "82c9366b3aa046fe8ab8d953c3ba1ff3"). Stick some xbasic in an important A5W page or on the TabbedUI that only lets them work ONLY IF their current session.sessionid matches the one saved in the users table.

When they log out, you don't need to do anything, you can leave the old sessionid in the users record.

Now, if they login from a second computer THAT becomes the working session. On the other machine, the session.sessionid no longer matches the one you just stored in the user table.

So they always can work on the most recent machine they used to login, but any previous sessions will fail.

Edit: if on the old machine, they are working in a tabbedUI or a grid you will need to add an ajax callback to the equation to do this compare and kick them out if required.

[reedallenbrown]

Re: How to allow a user to only login once.

Sounds great but way over my head.

[Steve Wood]

Re: How to allow a user to only login once.

Which part is difficult, maybe we can help. Do your users login? If so is the login page named login.a5w? Do you have a table that stores the details of each user that can login (name, address, etc.)?

[reedallenbrown]

Re: How to allow a user to only login once.

Yes I use users login. The log in page is called login.a5w. Yes I have a sql table that stores that information.

[Steve Wood]

Re: How to allow a user to only login once.

Then try:

- add a field to your users table named sessionid, char(32)
- add this code to your login.a5w page. It can go at the very top (adjust to fit your sql syntax and database structure, and add error checking). This updates sessionid in their users table.

if eval_valid("submitbutton")
if eval_valid("userid") '== means they logged in
dim pUser as p
dim pUser.userid as c
A5WS_Logged_In_User_Values(pUser)
dim cn as sql::connection
cn.open("::name::conn")
vSql = "UPDATE web_users SET sessionid = session.sessionid WHERE userid='"+pUser.userid + "'"
cn.execute(vSql)
cn.close()
end if
end if

- Create a test page to test this out. Add this to the top of that page:

dim pUser as p
dim pUser.userid as c
A5WS_Logged_In_User_Values(pUser)
if session.sessionid = sql_lookup("::name::conn","web_users","userid='"+pUser.userid+"'","sessionid")
?"We will let you continue."
else
?"Sorry, you logged in somewhere else, this session is closed."
end if

- Now login from one computer and hit your test page should say "We will let you continue"
- Go to a second computer and login, it should also say "We will let you continue".
- Go back to the first computer and refresh the page, should tell them they logged in somewhere else.

If all that works, then we can take the next step to apply it where needed.

[reedallenbrown]

Re: How to allow a user to only login once.

Can you or do you know someone that can do this for me for a fee? I always have things that need to be done and could use some help.

[madtowng]

Re: How to allow a user to only login once.

As a consideration to the end user, who may have been the victim of a BSOD, or may have simply forgot to close a page before leaving work (or home), wouldn't it be better to close the old session than the new session ?

[Steve Wood]

Re: How to allow a user to only login once.

Reed, I can do it for you tomorrow sometime. I will test out the theory first on my machine. I like this potential solution because it has a natural flow. The user probably intended to abandon the previous session, so it gets shut down if they open a new one. I've never tried to "delete a session" which has been proposed here; I'm not sure how you know which is the session you want to close. Sessions are created when someone goes to the website, even when Google indexes the site. It is not dependent upon someone logging in. Inactive sessions "delete" anyway after a period of inactivity, your session timeout.

[reedallenbrown]

Re: How to allow a user to only login once.

Thanks Steve. Please let me pay you for your time. Email me at [email protected]

[madtowng]

Re: How to allow a user to only login once.

Steve,

My suggestion assumes an extra field to tell if the session has ended.
This would give the option of checking for open sessions, and closing
whichever ones don't match the current session id.

[Steve Wood]

Re: How to allow a user to only login once.

Again, I don't know how you close an existing session, and how you know which one(s) belong to any particular individual.

[madtowng]

Re: How to allow a user to only login once.

Assume the following.
Log-table fields:

user_ID
sessionID
sessionIP
sess_beg
sess_end


My logic would check the log-table for an active session before logging the user in.
If a session exists, clear and/or logout the user, then allow the login procedure to continue.

I have not confirmed this will work, but the logic seems to be right.