如何在php中限制每个用户的并发登录数

Question

I want to prevent the user's concurrent login based on the admin settings.

If admin set the concurrent login settings as 3, then the user can login from 3 different places at a time.

If the user attempts to login from 4th place, the application should not allow the user to login.

Any idea how to maintain this via database. Please help. Thanks in advance.

Answer 1

You could maintain a DB-table with active user sessions, where a session is considered active, if last user activity took place less then X minutes ago (configurable value).

Each time a user tries to authenticate throgh the login form, you should check how many sessions for that user are active at the moment, and based upon that check make a decision whether to authenticate him or decline with some form of response message.

Answer 2

Fully working example (download)

what you do is that you add an extra column to your users table , name it logins. Whenever the user logs in increment the column by 1, and in you login script u can check if the number of logins is equal to the limit and when the user logs out then you decrease the no of logins by 1.

A problem that might arise using this method is that if the user doesn't log out and the server does not recognize the sessionn again the login is not decremented. To avoid this a better way of doing it is below.

1. Create a column name it logins and give it a data type of varchar(500) or preferably text because it might be difficult to predict the size of data we are expecting.

2. when the user logs in, check if the logins column is empty, if it is empty, create a json that contains the session_id, time of login using the time() function.

    if($column_login == '' or count(json_decode($column_login)) == 0){ $login_json = json_encode([ ['session_key'=>'session_key_generated', 'time' => time()] ]); //then update the logins table with the above }

3. If the logins column is not empty or the count of the column when decoded is greater than zero, then you check if the count is greater than login limit, if the number of logins is not yet greater than the login limit, then append the new session to the logins column in the database table

   if(count(json_decode($column_login)) > 0 and count(json_decode($column_login)) < $login_limit){ $login_json = json_decode($column_login); $login_json[] = ['session_key'=>'session_key_generated', 'time' => time()]; $login_json = json_encode($column_login); //update the logins column with the new $login_json and log the user in }

4. If the login limit is reached then check through the logins and check for the one with expired time, for example, a user that is not active of 300secnds is assumed to be logged out, then you delete the session that has expired from the table

   if(count(json_decode($column_login)) >= $limit){ $logins = json_decode($column_login); foreach($logins as $key => $login){ if($login['time'] < time()-300){ //this checks if the iterated login is greater than the current time -300seconds and if found to be true then the user is inactive //then set this current login to null by using the below statement $logins[$key] = null; // or unset($logins[$key]) either should work; } } //after iteration we check if the count of logins is still greater than the limit if(count($logins) >= login_limit){ //then return a login error that maximum logins reached }else{ //then login is successsfull } //update the logins column to equal to json_encode($logins); }

5. In any request that is been made by a logged user you check if the session key still exists in the login column of the database ($logins['session_key']), and if it is not found then log the user out immediately to avoid escalation of right and if otherwise then update the $login['time'] to the new time().

This method works well.

Answer 3

I have implemented something based on @MaheshKathiriya

I have a table named user having columns 'id' (PK,AI), 'username', 'password','login'
serialize() converts an array to a string, and unserialize() converts a serialized string back to an array

In login column, I have inserted an array (let's call it main_array) which contains sub arrays.
Number of sub arrays in main_array indicates number of registered session in DB.
The sub array has two values, session_id and time_of_login.

Whenever a user logs in we check if the number of sub arrays in main_array.

If main_array is empty, we insert a new sub array with corresponding session_id and time and allow user to login.

else if main array is not empty we check how many sub arrays are in it. If number of sub arrays is more than 0 and less than login_limit than we insert a new sub array and allow user to login.

else if number of sub array in main_array is equal to or more than login_limit, then we check for expired session (sub_array['time']>time()-60, means this session was active more than 60 seconds ago)
if a session was not active for last 60 seconds we delete it's sub array from main array.
now we again check if number of sub array in main_array is equal to or more than login_limit, if it's less than login limit, we allow to login and insert new session sub_array to main array. else the logins fail (because there are no in active sessions which could replace the current user trying to login) insert a new sub array to the main_array with corresponding session_id and login time.

<?php
if($_SERVER['REQUEST_METHOD']=='POST'){
  require('db_config.php');
  $session_id = session_id();
  $type = $_POST['type'];
  if($type=='login'){ //if user is trying to login
    $login_limit=3; //this is going to be the limit simultaneous logins
    $username=$_POST['username'];
    $password=$_POST['password'];
    $authenticated = false;

    $sql="select * from `user` where `username` = '$username' and `password` = '$password'";
    $result = $conn->query($sql);
    $count = mysqli_num_rows($result);
    if($count>0){
      $authenticated=true;
      $row = mysqli_fetch_assoc($result);
      $user_id = $row['id'];
    }
    else{
      $authenticated=false;
    }
    if($authenticated){ //doing it this way isn't necessary


      $get_login = "SELECT `login` FROM `user` WHERE  `username` = '$username' and `password` = '$password'";
      $result = $conn->query($get_login);
      $row = mysqli_fetch_assoc($result);
      $login_column = $row['login']; //this contains serialized array of login details;
      if($login_column=='' || count(unserialize($login_column))==0){ //if the column is empty i.e  it's first time login, or there are no users logged in
        echo "login column is empty <br>";
        $sub_array = array('s_key'=>$session_id,'time'=>time());
        $main_array=array($sub_array);

        //update login column
        $main_login = serialize($main_array);
        $update_login = "UPDATE `user` SET `login` = '$main_login' WHERE  `username` = '$username' and `password` = '$password'";
        $isUpdated = ($conn->query($update_login) && ($conn->affected_rows>0));
        if($isUpdated){
          echo "main 1 updated<br>";
          echo "login succesful<br>";
          $_SESSION['isLoggedIn']=true;
          $_SESSION['username']=$username;
          $_SESSION['password']=$password;
        }
        else{
          echo "main 1 not updated <br>";
        }
      }
      else if(count(unserialize($login_column))>0 && count(unserialize($login_column))<$login_limit){ //else if coulmn is not empty but doesn't have max simultaneous logins
        echo "Login column is not empty and has ".count(unserialize($login_column))." logins atm <br> Will insert this login now<br>";
        $main_array = unserialize($login_column);
        $sub_array = array('s_key'=>$session_id,'time'=>time());
        array_push($main_array,$sub_array);

        //update login column
        $main_login = serialize($main_array);
        $update_login = "UPDATE `user` SET `login` = '$main_login' WHERE  `username` = '$username' and `password` = '$password'";
        $isUpdated = ($conn->query($update_login) && ($conn->affected_rows>0));
        if($isUpdated){
          echo "main 2 updated<br>";
          echo "login succesful<br>";
          $_SESSION['isLoggedIn']=true;
          $_SESSION['username']=$username;
          $_SESSION['password']=$password;
        }
        else{
          echo "main 2 not updated <br>";
        }

      }
      else if(count(unserialize($login_column))>=$login_limit){ //else if max login has been reached,
        echo "limit reached in login column, now inactive sessions will be removed and this one will be logged in <br>";
        $logins = unserialize($login_column);
        foreach ($logins as $key => $value) {
          if($value['time']<time()-60){ //change 60 to whatever timelimit you want
            unset($logins[$key]);
          }
          // code...
        }
        //after iteration we check if the count of logins is still greater than the limit
        if(count($logins) >= $login_limit){
            //then return a login error that maximum logins reached
            echo "max logins reached, login FAILED!<br>";
        }else{
            //then login is successsfull
            echo "SUCCESS!<br>";
            $_SESSION['isLoggedIn']=true;
            $_SESSION['username']=$username;
            $_SESSION['password']=$password;

        //update login column
        $main_array = ($logins);
        $sub_array = array('s_key'=>$session_id,'time'=>time());
        array_push($main_array,$sub_array);
        $main_login = serialize($main_array);
        $update_login = "UPDATE `user` SET `login` = '$main_login' WHERE  `username` = '$username' and `password` = '$password'";
        $isUpdated = ($conn->query($update_login) && ($conn->affected_rows>0));
        if($isUpdated){
          echo "main 3 updated<br>";
        }
        else{
          echo "main 3 not updated <br>";
        }
      }

      }
      else{
        echo "something went wrong";
      }
    }
  }
  else if($type == 'logout'){
    // $_SESSION['isLoggedIn']=true;
    $username=$_SESSION['username'];
    $password=$_SESSION['password'];

    $get_login = "SELECT `login` FROM `user` WHERE  `username` = '$username' and `password` = '$password'";
    $result = $conn->query($get_login);
    $row = mysqli_fetch_assoc($result);
    $login_column = $row['login'];

    $searchLogin = unserialize($login_column);
    foreach ($searchLogin as $key => $login) {
      // code...
      if($login['s_key']==$session_id){
        echo "<br> session found: ".$login['s_key']."==".$session_id."<br>";
        unset($searchLogin[$key]);
      }
    }
    //update login column
    $main_array = ($searchLogin);
    // $sub_array = array('s_key'=>$session_id,'time'=>time());
    // array_push($main_array,$sub_array);
    $main_login = serialize($main_array);
    $update_login = "UPDATE `user` SET `login` = '$main_login' WHERE  `username` = '$username' and `password` = '$password'";
    $isUpdated = ($conn->query($update_login) && ($conn->affected_rows>0));
    if($isUpdated){
      echo "logged out<br>";
    }
    else{
      echo "FAILED Logout <br>";
    }


  }
}
?>
<form class="" action="index.php" method="post">
  <input type="text" name="username" value="">
  <input type="password" name="password" value="">
  <input type="hidden" name="type" value="login">
  <button type="submit" name="button">login</button>
</form>
<form class="" action="index.php" method="post">
  <input type="hidden" name="type" value="logout">
  <button type="submit" name="button">logout</button>

</form>