Member Avatar for Rico_2

I want to create a login system in Codeigniter 4 like this so when the user has logged in on 1 browser / other device, and tries to log back in on another browser / other device then for the first login he will be logged out automatically

examples like this I log in to the Mozilla browser and I try to log in again in the Chrome browser, then when I log in again in the Chrome browser my login in the Mozilla browser will log out

Edited by Rico_2
  • 3 Contributors
  • 5 Replies
  • 150 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by rproffitt

Dani AI

Generated

Short summary and practical path forward (builds on and the discussion): browsers themselves won’t kick each other out — the application must. The reliable, production-friendly way is to enforce a single authoritative authentication record on the server and make every protected request validate against it. That lets a new login immediately render older sessions invalid.

Concrete CI4 design pattern to follow:

  • Use a central session store (database, Redis, etc.) so sessions can be invalidated from the server side and work across multiple web nodes.
  • On successful login, create a new session and update a single “current session” reference for that user (in a user_sessions table or a column on the users row). Immediately remove or mark any previous session records for that user as invalid.
  • Protect routes with a CI4 Filter that compares the active server-side session record to the request’s session. If they differ, destroy the request session and redirect to login. Regenerate the session identifier on login to avoid fixation.
  • When running multiple servers, make sure sessions and that “current session” data are shared (DB or central cache).

Real-time UX and trade-offs:

  • For immediate logout notice on already-open pages, use a push channel (WebSocket/SSE) or short client polling. Polling is simplest but costs requests; push is responsive but more complex.
  • Provide a user UI for “active sessions” so users can see and manually revoke devices.

Security and operational notes:

  • Always use HTTPS, Secure and HttpOnly cookies, and appropriate SameSite settings. Treat “remember me” tokens differently from active sessions. Keep session lifetimes reasonable and implement server-side cleanup of stale session records. As noted, default setups usually allow multi-device logins — enforcing single sessions is an application decision with UX implications.

Recommended Answers

All 5 Replies

Member Avatar for Dani

I don’t have experience with CI4 but I wrote DaniWeb on CI3. What do you mean about double login? Maybe I can do some research and help.

commented: I've edited my question +0
Member Avatar for rproffitt

I think you need a better example. I'm currently logged in on my phone, laptop and another tablet with Chrome. I can only guess there is some Google setting I haven't explored yet.

commented: i mean like i just can one time login +0
commented: i mean like this now i login in mozila browser then i open another browser like chrome if i login in chrome yang login in mozila will auto logout +0
Member Avatar for Dani

OK, I see the updated question now.

You should be able to do this by, each time that a user logs in, store a cookie in their web browser with a random token / string. Then, store a flag in the database for the user of that same token / string. Each time that they load a page on your site, compare the value in user's cookie to see if it matches the value associated with the user in the database. If they don't match, log the user out. If they do match, then you know the latest login was performed from that browser.

Member Avatar for rproffitt

: i mean like this now i login in mozila browser then i open another browser like chrome if i login in chrome yang login in mozila will auto logout

I'm currently logged in on Firefox and Chrome so the stock setup doesn't autologout.

Remember that we can configure PCs and apps almost anyway we want. Here I can't guess how you made these browsers do that. You would have to tell me how you did that.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.