禁止用户同时从两个或多个Android设备登录

Question

Let's say I have Android app with user login functionality and PHP based back-end server. When user fills required fields (name and e-mail for example) with according information and press "login" button, request is being made to back-end server. Now let's say user is successfully logged in.

My question would be, does exist any common used mechanisms/solutions/design patterns similar to web

sessions

between Android apps and server side in order to implemement such functionalities like login/logout, prevent users to login with the same account at the same time, etc.?

Answer 1

Why use something similar to php sessions? use php sessions instead!

session_start();
$sess_id = session_id();

Give this id to your client, and make sure it appears in every requests the client application makes to your server.

Here is how you load a session by id :

session_id("your_client_session_id");
session_start();

Basically it's the same usage than web, except browsers use cookie to store the session_id.

Then if you are using org.apache.http in your client application, you should be able to use org.apache.http.cookie . This way you can set your PHP_SESSID in a cookie, and your application will automatically send this in every request.

Answer 2

Since different instances of the app presumable authenticate via the same remote service (the PHP backend), it could be part of that implementation to track when an identity has authenticated and from which device. Then you would need a way of tracking how long a user is active in the given sessions (like sending a "ping" from the app at an interval as long as it runs).

Using this information (last login, last ping) it could be exactly determined if an identity has an active session and deny access to subsequent authentication attempts of the same identity.

It's up to the implementation how active session is defined. It may be active as long as the app runs, as long as the app is in the foreground, as long as the user keeps interacting with it not exceeding a certain idle time threshold, etc. The point is to log and collect information of all sessions on the server side.