Question

i have a user login system which works off of sessions such that when the user logs in a session variable of user is populated with his/her username, then each page she loads checks this session, if it is not populated then the page is redirected to the login page. apon logout the session is destroyed.

But this still allows a user to open 2 different browsers at the same time and login. I want to stop this, such that if a user logs in and then trys to login using a different browser or pc, they get an error saying the user is already logged in.

So my first thought was to use a data base write, but then how do i know to unset that value if the browser is closed?

all my pages are php, and i use ajax and php scripts to update dynamic content.

So whats the best way to go about this?

Answer 1

they get an error saying the user is already logged in.

That’s wrong approach, causing terrible user’s experience.

Make it opposite: let that latter in, but make previous one logged out.
You only need to store current session ID in the user’s table. If it doesn’t match – ask for login.