?
Solved

PHP single user login control for website

Posted on 2007-03-22
8
Medium Priority
?
5,599 Views
Last Modified: 2012-06-22
Dear experts,
I have a problem here. I have search experts-exchange site for some time, but i failed to
find a proper solution.

I am setting up a web site (written in PHP) that will allow multiple user login simultaneously.
But one user is allow to have only one active session at any time.

What I have done to acheive this is:
1) Set up a database table with 2 fields, username & timestamp.
2) On login page, while user sign in, the script will delete any session entry that is more than 20mins old. Then check if the username has an entry in the table. If it is, login failed. Else, login successfull.
3) After a user login, set the username into the session variable, e.g. $_SESSION['username'],
and insert the username and time() into the DB.
4) On top of every web page, the script will check if the session variable is empty. If it is,
it will redirect the user back to login page.
5) Following the check session variable script, a script will update the timestamp in the DB table.
The same script will check if the timestamp in the DB table is more than 20mins old. If
it is, the entry will be deleted.
6) When a user logout, the logout script will remove the user's entry in the database table.

The problem:
When a user logged in the system, his username will always be shown on screen. It is a
direct echo from the $_SESSION['username']. But sometimes, the username will disappear. I
assume the session is expired. But, he still can browse the site freely. Suppose when he
browse other page, the first script that check the session variable will get an "Empty" value,
and redirect the user to login page. But somtimes it didn't happen. In this condition, even though
the user click on logout, the entry in the database table remains because of missing username for deleting
the DB table entry. Then the user will have to wait for 20mins (or less) in order to sign in again.

If the user just close the browser window without click on logout. The entry in DB will
remain and the user will have to wait for 20mins to login again.

Sometimes when a user let the page idle for a while,  he click on a link to another page,
it will redirect to the login page. I guess this is due to the system session expired. It is
what the script is doing. But the login data entry in the DB table remains. It will need 20mins
for the user to login again.

Question:
Is there any proper way to avoid a user wait for 20mins to relogin into the web site?
Well, I have been thinking to set the time to 5mins. But, it still didn't
solve the problem.

What is really happen to the session variable. When it expires, the PHP script should
log (redirect) the user out. But sometimes it didn't.

Other info:
1) Script to set the session variable:
$_SESSION['username'] = $username;

2) The script to check seesion:
if (!isset($_SESSION['username']))
{
      header('Location:index.php?redirection=' . urlencode($_SERVER['PHP_SELF'] . '?' . $_SERVER['QUERY_STRING']) );
      exit;
}

0
Comment
Question by:llping8
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
8 Comments
 
LVL 14

Accepted Solution

by:
Vel Eous earned 600 total points
ID: 18775335
Try the zend_auth framework module:

http://framework.zend.com/manual/en/zend.auth.html
0
 
LVL 10

Assisted Solution

by:ClickCentric
ClickCentric earned 400 total points
ID: 18776589
What you want is a custom session handler that utilizes the database rather than the session files.   Though it sounds like there's a flaw somewhere in your session implementation which unless fixed would likely still not work right even if you did put it in a database.
0
 

Author Comment

by:llping8
ID: 18776727
I am thinking, it may because of the session.gc_maxlifetime = 1440 (which is 24minutes) that cause the session variable disappeared. But if it is cleaned, user should be redirected to login page. It must be something wrong. I have to recheck the implementation.

I have refer to zend_auth framework, i can't find a way to implement it to solve my problem yet.
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 

Author Comment

by:llping8
ID: 18790923
Dear experts,
I have change my approach.
I leave the session alone and work on the single user login separately.
Now, I include an IFRAME on every page. In the frame, there is a PHP page that with HTML META tag - refresh.
 
The PHP code in IFRAME will update the database with the latest time every 15sec. Thus, as long as the user is viewing a page, it will refresh, and the username will always exist in the DB table. The same username cannot login again. If the existing user logout or close the window, the DB table will stop being refreshed. Another code will check and delete those entries with idle time more than 30 seconds. After that, the same user can login again. So, the longest time a user have to wait is around 30sec.

It works fine. But it seems like the original session.gc_maxlifetime is not working anymore. The user session will not expire after idle for 24 mins.
0
 
LVL 10

Expert Comment

by:ClickCentric
ID: 18798961
You're breaking your session, that's why it's not timing out.  Your workaround really is not a good idea.  What happens if someone leaves their computer on that page?  Do you just let it refresh forever? You really should figure out what's wrong with your session implementation and fix it.  I'm not sure why you're so interested in storing it in the database, but you can use a custom session handler for that and it's really not that hard.  
0
 

Author Comment

by:llping8
ID: 18799003
Dear ClickCentric,
You are correct. The concern is if someone keep the page open forever.
I don't understand how to use a custom session handler for the purpose of letting one user to login at one time. Can you show me how? In my knowledge, if someone login the system, the session will register. But then, if he try to login using another computer or browser, how can the system know that the user already login? because they are 2 different session. Can one session check if there is another session that has the same userid exist?
Thanks.
0
 
LVL 10

Expert Comment

by:ClickCentric
ID: 18799055
If they're logging in, they're using some sort of username.  You determine whether they're logged in based on that.  Whether or not you use sessions to store that information is another matter.  Session handlers are good for that, but I think you're misunderstanding how sessions operate and what you have to do in order to prevent them from going away/timing out.  You should really look at www.php.net and read up on them.  Or even better, find a book that deals with them with real-world scenarios.  They have to be interwoven into your site and they sometimes require parameter tweaking to get the desired results.  It's not the type of thing where I can just say add this line to this file and everything will work (while it is possible that's all you need, I'd need to see all of the source code to determine that).  
0
 

Author Comment

by:llping8
ID: 18805639
Thank you very much. ClickCenteric.
I appreciate your information. I think I need to do a deep study in this issue.
0

Featured Post

WordPress Tutorial 3: Plugins, Themes, and Widgets

The three most common changes you will make to your website involve the look (themes), the functionality (plugins), and modular elements (widgets).

In this article we will briefly define each again, and give you directions on how to install them.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article discusses four methods for overlaying images in a container on a web page
Many old projects have bad code, but the budget doesn't exist to rewrite the codebase. You can update this code to be safer by introducing contemporary input validation, sanitation, and safer database queries.
Learn how to match and substitute tagged data using PHP regular expressions. Demonstrated on Windows 7, but also applies to other operating systems. Demonstrated technique applies to PHP (all versions) and Firefox, but very similar techniques will w…
The viewer will learn how to create a basic form using some HTML5 and PHP for later processing. Set up your basic HTML file. Open your form tag and set the method and action attributes.: (CODE) Set up your first few inputs one for the name and …
Suggested Courses

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question