Question

I suppose the answer is – “it depends on your app” ?

If I log in twice, each calls session_start() and I end up with two totally independent sessions. Each login is timestamped, as is each logout (log time of zer0 – set at login – indicates user is still logged in).

I have an audit trail where every new row added to a table (I never modify, to support the audit trail) has user_id and timestamp.

Question: is there any compelling reason to allow or disallow multiple logins? I thought at first to disallow, but now I don’t see any real reason to do so – and allowing it means no extra code.

What’s the general practise?

Answer 1

If there is no danger to user security, allow multiple, but if there are any security threats, i would only use a single login. Like leaving two profiles logged into facebook at two different houses, possible, but is it safe?