Solved

PHP single user login control for website

Posted on 2007-03-22
8
5,543 Views
Last Modified: 2012-06-22
Dear experts,
I have a problem here. I have search experts-exchange site for some time, but i failed to
find a proper solution.

I am setting up a web site (written in PHP) that will allow multiple user login simultaneously.
But one user is allow to have only one active session at any time.

What I have done to acheive this is:
1) Set up a database table with 2 fields, username & timestamp.
2) On login page, while user sign in, the script will delete any session entry that is more than 20mins old. Then check if the username has an entry in the table. If it is, login failed. Else, login successfull.
3) After a user login, set the username into the session variable, e.g. $_SESSION['username'],
and insert the username and time() into the DB.
4) On top of every web page, the script will check if the session variable is empty. If it is,
it will redirect the user back to login page.
5) Following the check session variable script, a script will update the timestamp in the DB table.
The same script will check if the timestamp in the DB table is more than 20mins old. If
it is, the entry will be deleted.
6) When a user logout, the logout script will remove the user's entry in the database table.

The problem:
When a user logged in the system, his username will always be shown on screen. It is a
direct echo from the $_SESSION['username']. But sometimes, the username will disappear. I
assume the session is expired. But, he still can browse the site freely. Suppose when he
browse other page, the first script that check the session variable will get an "Empty" value,
and redirect the user to login page. But somtimes it didn't happen. In this condition, even though
the user click on logout, the entry in the database table remains because of missing username for deleting
the DB table entry. Then the user will have to wait for 20mins (or less) in order to sign in again.

If the user just close the browser window without click on logout. The entry in DB will
remain and the user will have to wait for 20mins to login again.

Sometimes when a user let the page idle for a while,  he click on a link to another page,
it will redirect to the login page. I guess this is due to the system session expired. It is
what the script is doing. But the login data entry in the DB table remains. It will need 20mins
for the user to login again.

Question:
Is there any proper way to avoid a user wait for 20mins to relogin into the web site?
Well, I have been thinking to set the time to 5mins. But, it still didn't
solve the problem.

What is really happen to the session variable. When it expires, the PHP script should
log (redirect) the user out. But sometimes it didn't.

Other info:
1) Script to set the session variable:
$_SESSION['username'] = $username;

2) The script to check seesion:
if (!isset($_SESSION['username']))
{
      header('Location:index.php?redirection=' . urlencode($_SERVER['PHP_SELF'] . '?' . $_SERVER['QUERY_STRING']) );
      exit;
}

0
Comment
Question by:llping8
  • 4
  • 3
8 Comments
 
LVL 14

Accepted Solution

by:
Tchuki earned 300 total points
ID: 18775335
Try the zend_auth framework module:

http://framework.zend.com/manual/en/zend.auth.html
0
 
LVL 10

Assisted Solution

by:ClickCentric
ClickCentric earned 200 total points
ID: 18776589
What you want is a custom session handler that utilizes the database rather than the session files.   Though it sounds like there's a flaw somewhere in your session implementation which unless fixed would likely still not work right even if you did put it in a database.
0
 

Author Comment

by:llping8
ID: 18776727
I am thinking, it may because of the session.gc_maxlifetime = 1440 (which is 24minutes) that cause the session variable disappeared. But if it is cleaned, user should be redirected to login page. It must be something wrong. I have to recheck the implementation.

I have refer to zend_auth framework, i can't find a way to implement it to solve my problem yet.
0
 

Author Comment

by:llping8
ID: 18790923
Dear experts,
I have change my approach.
I leave the session alone and work on the single user login separately.
Now, I include an IFRAME on every page. In the frame, there is a PHP page that with HTML META tag - refresh.
 
The PHP code in IFRAME will update the database with the latest time every 15sec. Thus, as long as the user is viewing a page, it will refresh, and the username will always exist in the DB table. The same username cannot login again. If the existing user logout or close the window, the DB table will stop being refreshed. Another code will check and delete those entries with idle time more than 30 seconds. After that, the same user can login again. So, the longest time a user have to wait is around 30sec.

It works fine. But it seems like the original session.gc_maxlifetime is not working anymore. The user session will not expire after idle for 24 mins.
0
How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

 
LVL 10

Expert Comment

by:ClickCentric
ID: 18798961
You're breaking your session, that's why it's not timing out.  Your workaround really is not a good idea.  What happens if someone leaves their computer on that page?  Do you just let it refresh forever? You really should figure out what's wrong with your session implementation and fix it.  I'm not sure why you're so interested in storing it in the database, but you can use a custom session handler for that and it's really not that hard.  
0
 

Author Comment

by:llping8
ID: 18799003
Dear ClickCentric,
You are correct. The concern is if someone keep the page open forever.
I don't understand how to use a custom session handler for the purpose of letting one user to login at one time. Can you show me how? In my knowledge, if someone login the system, the session will register. But then, if he try to login using another computer or browser, how can the system know that the user already login? because they are 2 different session. Can one session check if there is another session that has the same userid exist?
Thanks.
0
 
LVL 10

Expert Comment

by:ClickCentric
ID: 18799055
If they're logging in, they're using some sort of username.  You determine whether they're logged in based on that.  Whether or not you use sessions to store that information is another matter.  Session handlers are good for that, but I think you're misunderstanding how sessions operate and what you have to do in order to prevent them from going away/timing out.  You should really look at www.php.net and read up on them.  Or even better, find a book that deals with them with real-world scenarios.  They have to be interwoven into your site and they sometimes require parameter tweaking to get the desired results.  It's not the type of thing where I can just say add this line to this file and everything will work (while it is possible that's all you need, I'd need to see all of the source code to determine that).  
0
 

Author Comment

by:llping8
ID: 18805639
Thank you very much. ClickCenteric.
I appreciate your information. I think I need to do a deep study in this issue.
0

Featured Post

Easy Project Management (No User Manual Required)

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Author Note: Since this E-E article was originally written, years ago, formal testing has come into common use in the world of PHP.  PHPUnit (http://en.wikipedia.org/wiki/PHPUnit) and similar technologies have enjoyed wide adoption, making it possib…
I imagine that there are some, like me, who require a way of getting currency exchange rates for implementation in web project from time to time, so I thought I would share a solution that I have developed for this purpose. It turns out that Yaho…
The viewer will learn how to count occurrences of each item in an array.
This tutorial will teach you the core code needed to finalize the addition of a watermark to your image. The viewer will use a small PHP class to learn and create a watermark.

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now