如何仅通过SessionID终止会话及限制同一凭证最多2人登录

Hey there! Let's tackle your two technical requirements with practical, actionable solutions:

The core idea here is to maintain a way to track active sessions and map them to their corresponding SessionIDs. Below are examples for common tech stacks:

• General Approach: Use a centralized session store (like in-memory cache, Redis, or your application's built-in session registry) that links SessionIDs to active session objects. To terminate a session, look up the SessionID in this store and trigger a destroy/remove operation.
• Java Servlet Example:
  You can iterate through all active sessions in the ServletContext and invalidate the matching one:

  public void terminateSession(String targetSessionId) {
      Enumeration<String> allSessionIds = getServletContext().getAttributeNames();
      while (allSessionIds.hasMoreElements()) {
          String currentId = allSessionIds.nextElement();
          HttpSession session = (HttpSession) getServletContext().getAttribute(currentId);
          if (session != null && targetSessionId.equals(session.getId())) {
              session.invalidate(); // Ends the session immediately
              break;
          }
      }
  }
  

• ASP.NET Example:
  Track sessions in an application-level dictionary, then abandon the matching session:

  public void KillSession(string sessionId) {
      var activeSessions = System.Web.HttpContext.Current.Application["ActiveSessions"] as Dictionary<string, HttpSessionState>;
      if (activeSessions != null && activeSessions.ContainsKey(sessionId)) {
          activeSessions[sessionId].Abandon();
          activeSessions.Remove(sessionId);
      }
  }
  

• Node.js (Express + express-session + Redis) Example:
  Since Redis stores sessions with keys formatted as sess:<SessionID>, simply delete that key:

  const redis = require('redis');
  const redisClient = redis.createClient();
  
  async function terminateSession(sessionId) {
      const redisSessionKey = `sess:${sessionId}`;
      await redisClient.del(redisSessionKey);
  }
  

Using your existing USER_ACTIVITY_LOG table, we can build a check to restrict concurrent logins. Here's how to implement it:

Step-by-Step Logic #

1. Resolve User ID from Credentials: When a user attempts to log in, first map their provided credentials (like admin/admin) to the corresponding USER_ID.
2. Count Active Sessions: Query the USER_ACTIVITY_LOG table to count how many sessions for this USER_ID are currently active (i.e., logged in but not yet logged out or timed out).
   The SQL query would look like this (it finds sessions where the last activity is a Login):

   SELECT COUNT(DISTINCT SESSION_ID) AS active_session_count
   FROM USER_ACTIVITY_LOG ual
   WHERE USER_ID = ?
     AND ual.ACTIVITY_CODE = 'Login'
     AND NOT EXISTS (
         SELECT 1 FROM USER_ACTIVITY_LOG ual2
         WHERE ual2.SESSION_ID = ual.SESSION_ID
           AND ual2.ACTIVITY_TIME > ual.ACTIVITY_TIME
           AND ual2.ACTIVITY_CODE IN ('LogOut', 'TimeOut')
     );
   

3. Enforce the Limit:
   • If active_session_count < 2: Allow the login, insert a new Login record into USER_ACTIVITY_LOG with the new SESSION_ID.
   • If active_session_count == 2: Reject the login request, return a user-friendly message like "This account has reached the maximum concurrent login limit (2 users). Please ask another user to log out first."
   • Optional Enhancement: If you want to auto-terminate the oldest active session instead of rejecting, use the SessionID from the oldest active session (modify the query to order by ACTIVITY_TIME ASC) and run the session termination logic from requirement 1, then proceed with the new login.

Key Notes #

• Session Timeout Handling: Set up a scheduled job to scan the USER_ACTIVITY_LOG table and add TimeOut records for sessions that have exceeded your application's idle timeout. This ensures inactive sessions don't count against the limit.
• Atomicity: Wrap the login check and log insertion in a database transaction to prevent race conditions (e.g., two users logging in at the same time when the count is 1, leading to 3 active sessions).

内容的提问来源于stack exchange，提问作者shrey mathuria