Prevent different users from logging into the same browser in PHP 7.4

0
votes

my first ever post here.

I've built out a login system (with password validation, strengths, checks to the DB, hashing, etc) and am nearly complete. I've got it to where I can prevent duplicate logins of the same user, checking against two fields in my database that are created during the login process: one is a randomly generated token in 'token' and the other is 'isSignedIn' either a 0 and 1. Currently, it prevents duplicate logging in for the same user and will also boot the person off on the next page action.

My next goal is to prevent two different users from logging into the same web browser on the same computer at the same time. I haven't found a solid answer for this after hours of searching.

Here is the issue I am having: during my testing, having logged in with multiple users in the same browser:

  1. I login with three different users into my portal; all three have
    their 'token' and 'isSignedIn' written to the DB

  2. I log off with one user and that user's token/isSignedIn value is
    deleted/ altered, respectively

  3. When I log out the other two users, the values for their 'token' and 'isSignedIn' remain in the database even though they are logged out successfully.

I can't figure out why logging out the one user prevents the other two from having their 'token' and 'isSignedIn' deleted upon sign out. It works for the first user, no problem. I assume there is some sort of session overlap that kills the other two. I can't tell clients to simply "only one person at a time on one computer on one browser" so I need some help.

I'd like to limit only one user on one browser at a time or prevent a second/ third/ fourth user from logging in the same browser.

Any help would be greatly appreciated!

Thank you.

Database Image Database Image

Logout Processor Logout Processor

1
phpauthenticationlogoutmultiple-users
How about a SESSION variable? You can set the variable anytime any user logs in. When the user requests the login page then your page can check for that variable. If the variable is found then report an error and don't show the login page. OR, you check your database 'isSignedIn' field, but that requires a trip to the server. - CharlesEF
You're using sessions somehow to track who is logged in. When you log in as the second user, you are overwriting the session for that browser, and it no longer has any idea that the first was ever logged in. You can confirm this if you make a page that echos $_SESSION['email'], and load that in the first tab (I assume you're logging in through multiple tabs?) after you've logged in on the second one. - Greg Schmidt

1 Answers

0
votes
  1. Please note that session is shared between all tabs of same browser.
  2. When you unset & destroy session after first user's log out, the value of $_SESSION['email'] is lost from other tabs.
  3. When you execute SQL statement to delete login it fails as it looks like: update ... WHERE email = ''

  4. To prevent more that one user to log into same browser, user session variable like the one you use (isSignedIn) and check its to redirect the user from login page to home page. Put following code on the top of login page:

and in log out actions add: $isSignedIn = 0;