销毁除最后两个之外的其他登录Wordpress会话

Question

I'm trying to add a function to the wp_login hook which scans all current user login sessions, and destroy all, except the last two (which contains current session). I'm want user to be logged in on max. two devices simultaneously.

I can fetch the sessions with:

$manager = WP_User_Meta_Session_Tokens::get_instance( $user->ID );
$tokens = $manager->get_all();

or:

$tokens = get_user_meta($user->ID, 'session_tokens', true);

But how can you destroy these sessions during a for loop?

foreach($tokens as $token){
  $manager->destroy( $token );
}

returns: hash() expects parameter 2 to be string. Using the keys as value doesn't work either.

Answer 1

I used a different approach for now, updating the user_meta directly did the trick

function limit_active_user_sessions( $user_login, $user ){

 $sessions = get_user_meta( $user->ID, 'session_tokens', true );
 $sessions_keys = array_keys($sessions);
 $sessions_count = count($sessions);
 $max_active_sessions = 2;
 if ( $sessions_count > 2 ){
  for($i=0;$i<($sessions_count-$max_active_sessions);$i++){ 
   unset( $sessions[$sessions_keys[$i]] );
  }
  update_user_meta( $user->ID, 'session_tokens', $sessions );
 }

add_action( 'wp_login', 'limit_active_user_sessions', 10, 2 );