Prevent multiple logins and limit max users

[TheDuke]

Re: Prevent multiple logins and limit max users

How do you propose to keep track of the total number of logged in users so they don't exceed their maximum?

[lgrupido]

Re: Prevent multiple logins and limit max users

Every time they log in or log out he is creating a record of it.

He is also tracking their session expiration time.

So at any point he knows who is logged in or who forgot to logout and their session has expired.

[TheDuke]

Re: Prevent multiple logins and limit max users

I am recording all of that along with the user agent and ip address. So now we're back to the reply I gave you originally about how this doesn't prevent an unscrupulous user from logging in with the same credentials multiple times because somewhere along the line I've got to remove the user record if they forget to logout and close their browser. In any event, I do like your idea of showing the company a list of current logins although this app is for a niche market and most of my clients only have one or two users and not more than five.

[lgrupido]

Re: Prevent multiple logins and limit max users

In Each UX you can setup a session timeout warning.

If that time out expires, then you can have it return to the login page.

[lgrupido]

Re: Prevent multiple logins and limit max users

I meant to add - Of course, that doesn't do any good if they close their browser window without logging out.

[TheDuke]

Re: Prevent multiple logins and limit max users

Trust me, I've tried a dozen different approaches and there's always a way to "beat the system". I'm in agreement with you in that I couldn't care less if they login 3 times with the same credentials or 3 different users as long as they don't exceed their licensed user count. I have several checks in place when a user attempts to login but the two most important are making sure that the login would not exceed the max user count and if they're already logged in (because there's a record in the logged in user table and they might have forgotten to logout) then I prompt them to either logout from the other session (if it's still open) or I display the number of minutes/seconds until it times out and then they can login again. If it's legit then the only downside is they have to wait a few minutes before logging in again, depending on how far they were into the session. But if it's someone trying to get tricky and there is another user still using the session then it will get updated every time there's an ajax callback and the second user will never be able to login with those credentials. All in all, I feel I've got it locked down fairly tight and although there might be other ways to accomplish what I'm trying to do I'm happy with what I have.

[TheDuke]

Re: Prevent multiple logins and limit max users

I've received a few requests asking to post some of the code but most of it is very straightforward and I'm sure most of you know what you're doing so I'm just going to give an overview of the process and if anyone needs help with any particular piece then let me know and I'll post it. I did feel that 12 minutes was a little too quick for the session timeout so I've bumped it to 30 so it's less restrictive. Most of my clients keep a separate browser open to run my app anyway so it's not really an issue unless they have a power outage or something. I'm also displaying a session timeout warning on each page before the session expires with an extension option.

1) I created a logged in user's table that stores the user ID, session ID, IP address, user agent and last activity timestamp. Much of this is just to help identify the source of a locked out user. Per someone's suggestion above, I'll probably add some of this info to the user list they already have access to.

2) When the user attempts to login, I use the canAjaxCallback event to see if logging in is what they're trying to do and then run the validation tests. First I make sure the user ID is in the registered user table for all users so if they aren't I don't waste any more time. If it is a valid ID then I check if there's already a record in the logged in user table for that ID.

3) If there is a record in the user table then I compare the current time to the last activity timestamp to see if their session has timed out. If it has then I allow them to continue on the the onLogin event for further processing. If it hasn't then I check to see if the session ID matches that in the logged in user table. If it does then I allow them to continue on to the onLogin event for further processing. If it doesn't (or doesn't exist) then I display a message with two options; a) go back and logout of the other session or, b) wait for the session to timeout where I'm showing them the minutes/seconds remaining.

4) In the onLogin event, I determine if the login was successful and if so, I check again to see if they're already in the logged in user table to determine if I need to do a sql update or a sql insert. In other words, if it's a new user logging in then I insert a record into the logged in user table but if the user's session timed out then I simply update the last activity timestamp.

5) While logged in, I have a reset timer function in the afterAjaxCallback events that updates the last activity timestamp whenever there's server activity. This does add a little overhead but I haven't noticed too much of a performance hit. If I do, then I'll look into implementing Redis or similar.

Thanks again for everyone's input.

[cornchild]

Re: Prevent multiple logins and limit max users

Ok, I did some googling to try and see how other folks do this too because I was also curious.

From what I read what about something like this?

> Each login to system log the userID, and IP Address.
> Each "proper" logout delete this record.

On each Login:
> Check to see if there is an active session in your log table by the users ip address and userID that matches the IP they have now.
> If TRUE don't do anything or maybe tell them "Hey next time logout properly and you won't get this annoying messagebox!"
> If FALSE prompt user and say hey you want to reconnect? If Yes update the record with this new IP.

On Each pages navigation:
> Check the userID and IP address of the session against your log table. If it is different log them out,reset session, and redirect them to the login screen.

This should work because you'll be updating the IP on login (Either a reconnect or a new session) and only checking on navigation.

An existing connected person will check against the existing records and be hit with a mismatch if someone logged in with their ID somewhere else while they were working away at this pc. They'll then get thrown back to login. Kind of like an Optimistic Concurrency check. You could even have it tell them the IP address of the other system that is using their ID now.

It might work. Haven't tested it myself.

[TheDuke]

Re: Prevent multiple logins and limit max users

Per my last post, although I couldn't find one that couldn't be defeated, there are probably other ways to accomplish the same task but my method works well and I'm happy with it. I will tell you that I've been down the IP address path and that definitely does not work. Whether you're using Request.GetHeader(“x-forwarded-for”) or Request.Remote_Addr to get the IP address, if the users are behind a firewall or proxy (and who isn't?) then all computers will return the same IP address.

[kkfin]

Re: Prevent multiple logins and limit max users

The truth is that today is important to hide the real IP. This is essential for servers and only way to avoid problems. If your domain name points to your servers real IP you are looking for troubles. For example there is no way you can protect your server from DDOS attack. If you face one it is too late to do anything with that IP. Only way to go on is to change server IP and hide it.