How to know if user is logged in with ion-auth 2

Question

I want to restrict access to my login system to only 1 for each login, I want my system to block access, if login is already being used on another device.

What would be the best practice to do that?

I’m using Codeigniter 3, along with the Ion-Auth 2 plugins. url of plugs https://github.com/benedmunds/CodeIgniter-Ion-Auth.

Answer 1

So the problem you want to solve is that the same user cannot be logged into two "machines" at the same time.

Using normal sessions, which stay on the server - either in memory or in the database - you only have one certainty: your user authenticated to the system. You can not find out if he is still logged in or not, unless he expressly informs you - ie: have asked to undress.

To know if the guy is still logged in, just at the time of login check if his email/login is in the database where you save the session (a SELECT email FROM session WHERE email = $email already resolves). The problem is that you may end up locking your user out of your system until the session expires.

However, there is a way for you to know if he is still using the system, if the tab is still open in his browser: you will use a websocket client and server side. I won’t dwell on the client implementation, but found a tutorial that looks good about that part.

Think about WebSocket as a chat room with the server, your client can send messages to the server and the server can send messages to the client and/or clients.

The problem is that this tutorial does not have the server implementation part WebSocket - because what you already have is a web server, HTTP. A library I found for PHP is Ratchet. You will literally need to run another server - on another port - to receive the client’s messages. At Ratchet would be something like:

class WSAuth implements MessageComponentInterface {
    public function onOpen(ConnectionInterface $conn) {
        // Store the new connection to send messages to later
        $this->clients->attach($conn);

        echo "New connection! ({$conn->resourceId})\n";
    }

    public function onMessage(ConnectionInterface $from, $msg) {
        // recebe a mensagem do cliente com login e senha
        // faz toda a verificação para autenticá-lo
        // manda o SessionID de volta pro cliente, e guarda o cookie.
    }

    public function onClose(ConnectionInterface $conn) {
       // desloga o usuário caso o cliente tenha se conectado antes
    }

    public function onError(ConnectionInterface $conn, \Exception $e) {
      // provavelmente você deve deslogar o cara se der erro também
    }
}

---

Another solution would be to send an Ajax every minute to the server and if the client doesn’t send it for 3 minutes you drop it.

Answer 2

Consulting to documentation ion_auth you can see that has a method logged_in() from the library itself. Returns TRUE if you are logged in.