避免在Web应用程序中进行多次登录

Question

The website is having auto-refresh.When an user login with the same username that is logged in already somewhere,how to logout the previous login?How to give a relogin page in the first browser window?

  Please provide some code snippets....


   Thanks in advance....

Answer 1

This post is dealing with a similar problem.

Without you specifying more details, it's difficult to answer your question properly. First of all, if a user opens another tab or window within the same browser, they will be still logged in using the previous login. This is normal behaviour.

If a user logs in using a different browser, then one thing you can do:

1. register a HttpSessionListener
2. when a session is created, using void sessionCreated(HttpSessionEvent se) , check if user's credentials and session id are in your database
3. if not, put them in a database table
4. if yes, then invalidate their previous session by deleting previous credentials in database
5. when a session is destroyed, using void sessionDestroyed(HttpSessionEvent se) delete user's credentials in database

One other thing. If you're going to use this approach, then you'll have to check with every browser request if your user's credentials are stored in a database. You can use a Servlet filter for this. This will, of course, be an overhead.

One more thing. If there's an exception in your session creation/destruction code, there's a danger of user's credentials aren't properly disposed of in database. You can handle this using database triggers to delete rows that are as old as your session timeout is.