Level 67
Nov 27, 2020
10
Level 1
Laravel - Prevent Multiple Login Of Same Credentials (logoutOtherDevices)
I have a Laravel web app where multiple users login but I need to prevent login if the user has already logged.
I know that Laravel has a method (logoutOtherDevices) to logout the user when a second user (same credentials) is login. But this method do not show any message when logout the user. I would like to inform the logged out user that another user has logged in.
How can I implement something like that?
Level 1
Thanks for quick response. But in that post it does not explain how to add a flash message for logout users and is that what i'm needing.
Level 1
@fylzero How should this be implemented with jetstream. I would like to disable the possibility of logging in on multiple devices.
I uncommented the Illuminate\Session\Middleware\AuthenticateSession middleware in App\Http\Kernel and added the following to the FortifyServiceProvider boot method:
Fortify::authenticateUsing(function (Request $request) { $user = User::where('email', $request->email)->first();
if ($user &&
Hash::check($request->password, $user->password)) {
//Auth::logoutOtherDevices($request->password);
Auth::logoutOtherDevices($request->get('password'));
return $user;
}
});
That doen't prevent logging in on different browsers with the same credentials.
1 like
Level 122
@Bervetuna it LOGS OUT OTHER browsers. It does not prevent login. If you have a question, start a new one.
1 like
Level 1
@Snapey That's the functionality that I would like to implement, Snapey: as soon as a user logs in, I would like him to be logged out from other browser sessions.
I asked my question here: https://laracasts.com/discuss/channels/laravel/jetstream-log-out-on-other-devices-on-log-in
Level 4
@Snapey No. It doesn't logout other brrowser if password is not changed
Level 122
How do you propose to 'flash' the logged out user. Their session will be closed. Nothing will happen until they send a request to the server. At this point, they are anonymous because they don't have a valid session, therefore you cannot give them a message.
Possible options
-
Prevent login whilst there is already an active session for the user. Display a message like 'already logged in elsewhere. Logout on other devices first'
-
Allow second login but do not logout the first session. Create a middleware that checks the number of sessions for the current user. If they have more than one session, and the request is coming from a session that was created earlier then redirect the user to a page that says 'session has been terminated by another login', and don't let them visit any other pages.
Level 1
Thanks for your time, Snapey. I like the first option. How can I implement that? I currently keep the sessions in the database.
1 like
Level 1
@ignaciomerlano did you get any solution?
Level 1
@Kumari_shwetha If you use database as a store method for sessions it will create table Session in your database.
Table will have column user_id. If it is NULL it is session for unregistered user. If it's number it is session for logged in user.
So before you log in user you just check Session table if user is already there.
Please or to participate in this conversation.