Does this help
Restricting User to One Session - Laravel 5.3
Hi All,
I want to restrict users in my app to only be able to login from one device. If they login from another device, any other device they're logged in from, the session should be destroyed.
After doing reading and trying to figure it out, I know I can destroy sessions, though how can I determine if that specific user already has an existing session?
Would I add any additional code to the logincontroller.php? Or somewhere else? Effectively flow would be;
User supplies username and password -> Posts to login controller -> Check if user has an existing session, if yes, destroy -> generates new session for this user
Thanks in advance!
Got this working. For reference for anyone who is also looking to achieve the same thing;
- Copy the function "sendLoginResponse" from AuthenticatesUsers.php in the framwork into your LoginController.php file. This overwrites the default sendLoginResponse function
- Update your users DB (migration & db seeds etc...) to have a session_id field, type: "text"
- Extend the sendLoginResponse function in your LoginController.php file to achieve what you want. My function now looks like below.
'''
protected function sendLoginResponse(Request $request)
{
$request->session()->regenerate();
$previous_session = Auth::User()->session_id;
if ($previous_session) {
\Session::getHandler()->destroy($previous_session);
}
Auth::user()->session_id = \Session::getId();
Auth::user()->save();
$this->clearLoginAttempts($request);
return $this->authenticated($request, $this->guard()->user())
?: redirect()->intended($this->redirectPath());
}
'''
Please or to participate in this conversation.