如何限制用户在具有不同用户类型的同一浏览器上的多个窗口上登录

Question

The login page and their functionality works fine, but now I got a problem, when the user logged in with one account and after login he/she open new window on same browser and type the loginviewcontroller.php it is not showing the previous loggedin.php page and user can login with different accounts on two windows at the same time.

How can I restrict the user to login on multiple windows?

I need the functionality like gmail, if the user logged in once in a browser when he /she open new window on same browser and type the www.gmail.com it shows the logged-in user information ... but not the gmail login page...

Please help me fix this problem.

Here is the loginviewcontroller code

<?php

header("Cache-Control: private, must-revalidate, max-age=0");
header("Pragma: no-cache");
header("Expires: Fri, 4 Jun 2010 12:00:00 GMT");

if (!isset($_POST['submit'])) {
    /// HTML code for login page....
} else {
    /// Here the values are posting...

    $Username  = $_POST['uname'];
    $Password  = $_POST['pwd'];
    $User_Type = $_POST['type'];
    session_start();

    If (!(empty($Username) && empty($Password) && empty($User_Type))) {

        $model = new UsersModel();

        $rowsCount = $model->checkUser($Username, $Password, $User_Type);

        if ($rowsCount != 0) {
            $_SESSION['user'] = $Username;

            header("location:loggedin.php");

        } else {
            echo '<script type="text/javascript">alert("Enter username and password correctly");
              window.location.href="LoginViewController.php";</script>';
        }
    }

   }
    ?>

Here is the loggedin.php code

<?php

session_start();
$_SESSION['logged_in'] = 'true';

if (!isset($_SESSION['user'])) {
    header('Location: LoginViewController.php');
    exit();
}
echo '"<div style="background:white; text-align:right"> Login as:' . $_SESSION['user'] . '
       <a href="LogoutViewController.php" style="text-align:right">Logout</a></div>"';
?>

Answer 1

You are setting a variable in the user's session. You can just not allow the user to login again when this variable is set, since he'll be already logged in.

Also, don't forget to call session_start(). i.e. you can put this at the very top of your login page:

session_start();
if (isset($_SESSION['user']))
  header("location:loggedin.php");