Have something like LOG table in the database.
On every successful login have a record inserted in it or just have a flag in existing table to indicate user logged in or not.
On every login if the logged_in flag is NO then allow user to enter after updating it to "YES". So if the same user id is entered from different machine or browser just check if tht user id is logged in. If already YES the give him a message "Already logged in".
Also implement HttpSessionListener and in OnSessionDestroyed just make sure the db table is updated to "NO" for logged_in flag. Bcoz there are chances that user can just close the browser instead of logout.
-Murali*
Main Topics
Browse All Topics
by: SordSordPosted on 2009-07-08 at 17:07:23ID: 24809614
Is the requirement to prevent multiple logins to the same account from multiple browsers (and would you also want to prevent multiple machines from logging in to the same account)? Or is the requirement to prevent a single machine from being able to simultaneously login to multiple accounts? Is it ok if a client has multiple browser windows open making requests?
From the JSP side of things, you will need a global object that you can store (client, session) pairs in (I'd tend to us a map of some sort). Which will allow you to prevent multiple sessions for a single client.
How to identify a client is the real trick and will depend on how you answered the first question. If it is really the machine you want, then the IP address is probably the best answer you're going to get. If it is just multiple simultaneous logins you want to prevent, then the client is really the login info. So after they send their login info, check if they already exist in your table and you can either reject the new login, discard the old session, or just treat the two sessions as one session.