Question

Im working in a Web App with Java and JSF. I have a simple login, if it finds the user in the database it creates a session and stores some information on it. That works great.
The thing is, I want to avoid two different people using the same user name and password at the same time. Something like account sharing. Only one user logged at one time.
I have been thinking this but I can’t find the correct approach.

Thanks in advance for all your help.

Answer 1

One way I can think of is to put a boolean field logged_in to the database and set it to true whenever someone log in and set it to false whenever someone log out or session expired. Set it to false when someone log out is easy. For the session expired part, I believe using JSF, you have a SessionScope managed bean storing information about the user after he log in. You can implement a @PreDestroy method for that managed bean and ask it to set the field to false before it is deleted on session expired event.

When someone send “username” and “password” to the server through the login panel, you just need to check if the logged_in field is true or not.