Re: Ensure single session per user

Xavier Noria
2010-02-17T15:52:27Z

On Wed, Feb 17, 2010 at 3:19 PM, Nick Gins
<lists-fsXkhYbjdPsEEoCn2XhGlw@public.gmane.org> wrote:

> I would like to add the ability to control that a single user can be
> logged in only once.  In other words, if User "A" logs in and
then
> another person with User "A" credentials logs in, it will destroy
the
> session of the first session and log them out.  As far as the security
> of the matter goes, I''d rather that the correct owner of User
"A" with
> valid access to email, reset their password so the other person will not
> have access.
> I am using restful_auth. plugin with the standard for the session
> controller. I am using the DB session if that mattters.   I''d like
to
> know if there is a built in method or before_filter available or if
> someone has already come up with a solution to make this possible.

Sessions are serialised (can''t be queried with ordinary SQL) and
handled by Rails, they may belong to anonymous users also depending on
the application. I wouldn''t touch sessions themselves. A simple
approach would be to add a session_id fk to your users table.

Let''s say persons p, q have credentials for account A. Let''s
say p is logged in.

When user q logs in, since session_id is not null (it has p''s session
ID) and it is different than q''s session ID, you just delete the
session record of p, assign the current session ID to session_id, and
save current_user.

When p comes back, the session with the session_id in his cookie is
gone, he''s been logged out.

But the logic is a bit strange, now p can log in again thus logging q
out back. Wouldn''t you prefer that q cannot log in while p has a
session? What is you current rationale?

--
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFF+G/Ez6ZCGd0@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk+unsubscribe@googlegroups.com.