Question

A feature that is currently missing from one of my web apps is that a single user can only be logged in on one machine at a time. That is, if the users logs in elsewhere, his previous session will be logged off.

This is due to my current users table having the columns:

user: id, username, hash, salt... cursession

When each user logs in, the session ID is put into the “cursession” field and on each page-load, is checked against the database. As a result, only one “session” can be active at a time.

1. Is the current table structure and method secure and standard? This system was pretty much improvised, and I have no professional experience.
2. What would be a way to allow multiple simultaneous logins? I’m simply thinking of adding a “sessions” table with more userid-cursession relations, but what’s the standard method for doing this?

Answer 1

I propose that you put the current logged in userid in the user’s session (as a session variable), and drop the cursession field from the table altogether. You don’t need to reinvent session handling since PHP already has it built-in.

That way the user can be logged in at multiple computers at once. Session variables are safe too, since they’re not manipulated by the browser. The only thing kept in the browser is a session id which identifies the current session, all other data is stored on the server-side. The only thing that will happen if the user changes his browser cookies is that he will be logged out (start an empty session), so he can’t force himself to log in as someone else.