Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

Ligonsker's avatar

Limit number of simultaneous user connections to his account

Hello,

Is there a way built-in in Laravel to limit the number of allowed simultaneous connections of user to his account? So that a user can log in from different devices, but limit the number. For example allow maximum of 5 devices to be connected to the same account.

Thanks

0 likes
8 replies
LaryAI's avatar
Level 58

One possible solution is to keep track of the number of active sessions for each user in the database. Whenever a user logs in, you can increment the session count and check if it exceeds the maximum allowed number of sessions. If it does, you can log out the oldest session and decrement the session count.

Here's an example implementation:

  1. Add a session_count column to the users table:
Schema::table('users', function (Blueprint $table) {
    $table->integer('session_count')->default(0);
});
  1. In the LoginController, increment the session count and check if it exceeds the maximum allowed number of sessions:
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;

class LoginController extends Controller
{
    public function login(Request $request)
    {
        $credentials = $request->only('email', 'password');

        if (Auth::attempt($credentials)) {
            $user = Auth::user();

            if ($user->session_count >= 5) {
                // Log out the oldest session
                Auth::logoutOtherDevices($request->password);

                // Decrement the session count
                $user->session_count--;
                $user->save();
            }

            // Increment the session count
            $user->session_count++;
            $user->save();

            return redirect()->intended('/dashboard');
        }

        return back()->withErrors([
            'email' => 'The provided credentials do not match our records.',
        ]);
    }
}
  1. In the LogoutController, decrement the session count:
use Illuminate\Support\Facades\Auth;

class LogoutController extends Controller
{
    public function logout(Request $request)
    {
        $user = Auth::user();

        // Decrement the session count
        $user->session_count--;
        $user->save();

        Auth::logout();

        $request->session()->invalidate();

        $request->session()->regenerateToken();

        return redirect('/');
    }
}
Ligonsker's avatar

@tisuchi yes it was just old so I thought it might not be good today.

Btw, I regarding Lary's answer - I upgraded to Laravel 10 and there is no such thing is LogoutController - is it something in the newer versions of Laravel Auth? Or it's a controller I should create myself?

tisuchi's avatar

@Ligonsker I believe by default you won't get any LogoutController.

You may need to make it own!

1 like
Ligonsker's avatar

@Snapey I am not sure if that's good or bad in this case haha - Does it mean he might be using outdated information, or, he has enough knowledge to know what's best? šŸ˜…

Eventually, I ended up overriding the authenticated() method, and not the login() as he mentioned.

But I do have a problem, Auth::logOtherDevices(..) does not do what Lary said, i.e. to log out the oldest device, but instead it logs out every other device, and it makes sense by the name of the method:

protected function authenticated(Request $request, $user)
{
    $user = Auth::user();
    if ($user->session_count >= 5) {
        Auth::logoutOtherDevices($request->password);
        $user->session_count--;
        $user->save();
    }
    $user->session_count++;
    $user->save();
}

Does Laravel have another method that really logs out only the oldest session?

1 like
realtebo's avatar

@Ligonsker did you find an answer?

Does Laravel have another method that really logs out only the oldest session?

Please or to participate in this conversation.