Re: Login and Sessions

C.R. wrote:

I have a login script which uses sessions and want to implement something that would allow a user to only log in once (this could be depending on IP or user name - I haven't decided how I want to go yet). I would appreciate any feed back on how this could be accomplished. I would like to use the session that is already set for a particular user, but not sure how to do this. If I have 100 users logged in and one of them tries to log in again - how would I check this against the sessions already set? TIA C.R.,

What I would do (and this is just one method out of who knows how many possible ones) would be to add a field to your login database (assuming you *do* have a database) that changes from 0 to 1 when they log in. You would want to have a timeout function on it, though, so if they accidentially logged out without logging out, they wouldn't be locked out. Another possible idea would be this: Add the field to the db but populate it with your SessionID. If they try to log in again, if that SessionID is valid (i.e. there is a SessionID identical to that one currently in use) they would be denied. I like this idea much better. Although I'm not sure how one can tell if a session is in use (besides doing an ls in the session_save directory... possible security risk?) unless you write your own custom session handler (not that hard - there are some good examples out there). Any other takers? -Dash