0

We have a web application which uses Struts 2, Spring and Hibernate.

Currently a user using two different browsers (IE and FF) can log in to the same account at the same time.

Now, when you hit the login button, we need to invalidate all other logins for that account.

e.g. A User logins to an account on Firefox. The same user logins to same account in IE. In this case when he logins in IE, his session in firefox needs to be invalidated.

Is there any way we can do this?

Please help

3 Answers 3

2

If you keep track of what user did log in in what session then yes, I think it can be done. You already have his identity, now on each login you go your list of all current logged in users and their sessions (kept in a whatever datastructure you like: i.e. a static hash map (I know statics are bad:-), but they also are useful at times) and invalidate his previous session.

You sit on the server, you have the powers to organize sessions as you like.

2
  • I'd say you can improve upon this two ways. To avoid the static, use spring or guice to inject a singleton. Secondly, if you have a cluster, or intend to move to one in the near term, you should store this information outside of a single server, as there is no guarantee the second login hits the same server. Memcached would probably work fine, though I could also see something more persistent like a DB being useful as well. You will need a mechanism to update ALL servers in the cluster, to let them know to invalidate the extra session. You may need some sort of pub/sub for this.
    – rfeak
    May 9, 2011 at 18:25
  • Yep, I agree it was a simplistic view not taking into account clustering. But like you have suggested memcached or similar method should work okay and take care of clusters. Session will be replicated by design (otherwise clustering won't work) so it is a matter of associating user identity with the session id. May 9, 2011 at 19:58
1

The key is "same account". I would never do this if the user logs in into different accounts from more than one browser.

When the user logs in, take a random value for a session variable, associated with the account. If the session's value is a different value than this one, then it's not a valid session.

1

Agree with Tomasz Stanczak.. But be sure to check the IP address through which the account is getting logged in for the second time. Else, there are high chances of logging out the original user for an intruder to log in :-)

In my opinion, I would go with ask the user to log out from some other place(say IE) before he logs in here (say FF). Take a look in to the feature that gmail has (bottom of the page- Account activity), you can sign out all other sessions from one place.

2
  • You are assuming that the intruder logged in second. May 9, 2011 at 17:15
  • We can't actually assume it. Account is already gone if the intruder logs in first.. :-) You need to add intelligence to that! It is complex, gmail has got one of the complex authentication system I ever saw. May 10, 2011 at 7:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.