仅允许用户的一个实例登录到网站

Question

At the moment, in my website several people could technically log in using the same username and password at the same time on different machines.

I want to make it so that if someone logs in then it automatically ends any session associated with that user. That way, only one instance of a particular user can be logged in at any one time.

I'm trying to figure out how to implement this. How can someone logging in and creating a new session destroy a specific session on a different machine?

Answer 1

Add a field called "login_token" (make it a randomly generated string) and each time the user logs in, generate a new string and update the login_token field. Also store the login_token in the session. If a users session login_token value does not match that of the one in the database then kill the session.