如何防止移动应用程序中的多次登录

Question

If we want to prevent multiple logins with same credentials in mobile application how can we do that and we do not have any sessions in mobile so can we do with token based authentication please give me some ideas how to do this.

I am implementing ionic 2 application with back end as node js. I would be very grateful to get suggestions. Thank you in advance.

Answer 1

您可以保存每个登录连接，并在每次创建新连接时断开所有以前保存的登录。

Answer 2

If you want to restrict multiple logins on same device and same application then Two possible solutions: 1. you can use device uuid Device plugin Device uuid will be unique. (Don't use device uuid as authentication token) Install it:

$ ionic plugin add cordova-plugin-device

ans usage

import { Device } from 'ionic-native';

console.log('Device UUID is: ' + Device.uuid);

2. On login you can use token base authentication.when ever user login save token in localStorage.and when ever app open (index page) check if token is present and still valid than takes user to dashboard otherwise to the login page.

Answer 3

If you don't have any sessions, then it's best to utilize tokens.

There's a great Node.JS API project that already implements tokens on Github, which I've forked and used in the past. You could browse this as an example.

Inside of this project, there's a config for the tokens like so:

var mongoose = require('mongoose');
var Schema = mongoose.Schema;

// AccessToken
var AccessToken = new Schema({
    userId: {
        type: String,
        required: true
    },

    clientId: {
        type: String,
        required: true
    },

    token: {
        type: String,
        unique: true,
        required: true
    },

    created: {
        type: Date,
        default: Date.now
    }
});

module.exports  = mongoose.model('AccessToken', AccessToken);

All you would need to do is change the logic to check for the clientId and token for authentication. If the clientId (which is auto-generated each time) is different, then log the user out; forcing them to re-authenticate.

With modern mobile devices, this can easily be done in Javascript with local storage:

var testObject = { 'one': 1, 'two': 2, 'three': 3 };

// Put the object into storage
localStorage.setItem('testObject', JSON.stringify(testObject))…

This allows infinite use on one device, but only ever one device at a time. You could also easily set an expiration on the token as well if you'd like to auto-log out after a period of time.