简体繁体 English

当用户登录另一浏览器时，使该浏览器中的用户会话无效？

[英]Invalidate a user session in one browser when user logins in another browser?

原文 2011-05-09 09:24:07 0 3 java/ spring/ struts2

We have a web application which uses Struts 2, Spring and Hibernate. 我们有一个使用Struts 2，Spring和Hibernate的Web应用程序。

Currently a user using two different browsers (IE and FF) can log in to the same account at the same time. 当前，使用两种不同浏览器（IE和FF）的用户可以同时登录到同一帐户。

Now, when you hit the login button, we need to invalidate all other logins for that account. 现在，当您点击登录按钮时，我们需要使该帐户的所有其他登录无效。

eg A User logins to an account on Firefox. 例如，一个用户登录Firefox上的帐户。 The same user logins to same account in IE. 同一用户登录IE中的同一帐户。 In this case when he logins in IE, his session in firefox needs to be invalidated. 在这种情况下，当他登录IE时，需要使他在firefox中的会话无效。

Is there any way we can do this? 有什么办法可以做到这一点？

Please help 请帮忙

3 个解决方案

If you keep track of what user did log in in what session then yes, I think it can be done. 如果您跟踪哪个用户登录了哪个会话，那么可以，我认为可以做到。 You already have his identity, now on each login you go your list of all current logged in users and their sessions (kept in a whatever datastructure you like: ie a static hash map (I know statics are bad:-), but they also are useful at times) and invalidate his previous session. 您已经有了他的身份，现在在每次登录时，您都会列出所有当前已登录用户及其会话的列表（保留在您喜欢的任何数据结构中：即静态哈希映射（我知道静态是不好的：-），但他们也有时会很有用），并使他之前的会话无效。

You sit on the server, you have the powers to organize sessions as you like. 您坐在服务器上，可以根据需要组织会话。

Agree with Tomasz Stanczak .. But be sure to check the IP address through which the account is getting logged in for the second time. 同意Tomasz Stanczak ..但请确保检查第二次通过该帐户登录的IP地址。 Else, there are high chances of logging out the original user for an intruder to log in :-) 否则，很有可能注销入侵者的原始用户以进行登录:-)

In my opinion, I would go with ask the user to log out from some other place(say IE) before he logs in here (say FF). 我认为，我会要求用户在登录到其他地方（例如FF）之前从其他地方注销（例如IE）。 Take a look in to the feature that gmail has (bottom of the page- Account activity), you can sign out all other sessions from one place. 查看gmail具有的功能（页面底部的“帐户活动”），您可以从一个位置注销所有其他会话。

The key is "same account". 关键是“相同的帐户”。 I would never do this if the user logs in into different accounts from more than one browser. 如果用户从多个浏览器登录到不同的帐户，我将永远不会这样做。

When the user logs in, take a random value for a session variable, associated with the account. 用户登录时，请为与该帐户关联的会话变量取一个随机值。 If the session's value is a different value than this one, then it's not a valid session. 如果会话的值与此值不同，则它不是有效的会话。