Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium


PHP single user login control for website

Posted on 2007-03-22
Medium Priority
Last Modified: 2012-06-22
Dear experts,
I have a problem here. I have search experts-exchange site for some time, but i failed to
find a proper solution.

I am setting up a web site (written in PHP) that will allow multiple user login simultaneously.
But one user is allow to have only one active session at any time.

What I have done to acheive this is:
1) Set up a database table with 2 fields, username & timestamp.
2) On login page, while user sign in, the script will delete any session entry that is more than 20mins old. Then check if the username has an entry in the table. If it is, login failed. Else, login successfull.
3) After a user login, set the username into the session variable, e.g. $_SESSION['username'],
and insert the username and time() into the DB.
4) On top of every web page, the script will check if the session variable is empty. If it is,
it will redirect the user back to login page.
5) Following the check session variable script, a script will update the timestamp in the DB table.
The same script will check if the timestamp in the DB table is more than 20mins old. If
it is, the entry will be deleted.
6) When a user logout, the logout script will remove the user's entry in the database table.

The problem:
When a user logged in the system, his username will always be shown on screen. It is a
direct echo from the $_SESSION['username']. But sometimes, the username will disappear. I
assume the session is expired. But, he still can browse the site freely. Suppose when he
browse other page, the first script that check the session variable will get an "Empty" value,
and redirect the user to login page. But somtimes it didn't happen. In this condition, even though
the user click on logout, the entry in the database table remains because of missing username for deleting
the DB table entry. Then the user will have to wait for 20mins (or less) in order to sign in again.

If the user just close the browser window without click on logout. The entry in DB will
remain and the user will have to wait for 20mins to login again.

Sometimes when a user let the page idle for a while,  he click on a link to another page,
it will redirect to the login page. I guess this is due to the system session expired. It is
what the script is doing. But the login data entry in the DB table remains. It will need 20mins
for the user to login again.

Is there any proper way to avoid a user wait for 20mins to relogin into the web site?
Well, I have been thinking to set the time to 5mins. But, it still didn't
solve the problem.

What is really happen to the session variable. When it expires, the PHP script should
log (redirect) the user out. But sometimes it didn't.

Other info:
1) Script to set the session variable:
$_SESSION['username'] = $username;

2) The script to check seesion:
if (!isset($_SESSION['username']))
      header('Location:index.php?redirection=' . urlencode($_SERVER['PHP_SELF'] . '?' . $_SERVER['QUERY_STRING']) );

Question by:llping8
  • 4
  • 3
LVL 14

Accepted Solution

Vel Eous earned 600 total points
ID: 18775335
Try the zend_auth framework module:

LVL 10

Assisted Solution

ClickCentric earned 400 total points
ID: 18776589
What you want is a custom session handler that utilizes the database rather than the session files.   Though it sounds like there's a flaw somewhere in your session implementation which unless fixed would likely still not work right even if you did put it in a database.

Author Comment

ID: 18776727
I am thinking, it may because of the session.gc_maxlifetime = 1440 (which is 24minutes) that cause the session variable disappeared. But if it is cleaned, user should be redirected to login page. It must be something wrong. I have to recheck the implementation.

I have refer to zend_auth framework, i can't find a way to implement it to solve my problem yet.
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.


Author Comment

ID: 18790923
Dear experts,
I have change my approach.
I leave the session alone and work on the single user login separately.
Now, I include an IFRAME on every page. In the frame, there is a PHP page that with HTML META tag - refresh.
The PHP code in IFRAME will update the database with the latest time every 15sec. Thus, as long as the user is viewing a page, it will refresh, and the username will always exist in the DB table. The same username cannot login again. If the existing user logout or close the window, the DB table will stop being refreshed. Another code will check and delete those entries with idle time more than 30 seconds. After that, the same user can login again. So, the longest time a user have to wait is around 30sec.

It works fine. But it seems like the original session.gc_maxlifetime is not working anymore. The user session will not expire after idle for 24 mins.
LVL 10

Expert Comment

ID: 18798961
You're breaking your session, that's why it's not timing out.  Your workaround really is not a good idea.  What happens if someone leaves their computer on that page?  Do you just let it refresh forever? You really should figure out what's wrong with your session implementation and fix it.  I'm not sure why you're so interested in storing it in the database, but you can use a custom session handler for that and it's really not that hard.  

Author Comment

ID: 18799003
Dear ClickCentric,
You are correct. The concern is if someone keep the page open forever.
I don't understand how to use a custom session handler for the purpose of letting one user to login at one time. Can you show me how? In my knowledge, if someone login the system, the session will register. But then, if he try to login using another computer or browser, how can the system know that the user already login? because they are 2 different session. Can one session check if there is another session that has the same userid exist?
LVL 10

Expert Comment

ID: 18799055
If they're logging in, they're using some sort of username.  You determine whether they're logged in based on that.  Whether or not you use sessions to store that information is another matter.  Session handlers are good for that, but I think you're misunderstanding how sessions operate and what you have to do in order to prevent them from going away/timing out.  You should really look at www.php.net and read up on them.  Or even better, find a book that deals with them with real-world scenarios.  They have to be interwoven into your site and they sometimes require parameter tweaking to get the desired results.  It's not the type of thing where I can just say add this line to this file and everything will work (while it is possible that's all you need, I'd need to see all of the source code to determine that).  

Author Comment

ID: 18805639
Thank you very much. ClickCenteric.
I appreciate your information. I think I need to do a deep study in this issue.

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Password hashing is better than message digests or encryption, and you should be using it instead of message digests or encryption.  Find out why and how in this article, which supplements the original article on PHP Client Registration, Login, Logo…
It’s a season to be thankful, and we’re thankful for users like you who engage on site, solve technology problems, and network with others in the industry. What tech are we most thankful for? Keep reading.
The viewer will learn how to look for a specific file type in a local or remote server directory using PHP.
The viewer will learn how to create and use a small PHP class to apply a watermark to an image. This video shows the viewer the setup for the PHP watermark as well as important coding language. Continue to Part 2 to learn the core code used in creat…
Suggested Courses

578 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question