This is a feature request to cater for the situation where one has left the location where the web site has been accessed, and have forgotten to log out.

To avoid having to travel back to the last computer used to log out, there should be an option to allow only one session, and let the new/current session kill the previous one, without the need access the computer that session was initiated from.

Optionally, also give users the ability to maintain serveral sessions and manually invalidate ("kill") single sessions from anywhere. That might involve giving the sessions names that might be reflected in the cookie name, so that each computer could be easily identified in the sessions list.

CommentFileSizeAuthor
#6 session_bump.patch1.81 KBZen
#1 session_autodrop.patch1.07 KBdrawk

Comments

drawk’s picture

StatusFileSize
new1.07 KB

Attached is a patch that accomplishes that.

A new setting is added to the settings page to choose to automatically drop the oldest session without prompting the user.

Leeteq’s picture

Thanks, will test it asap.

This feature can help increase security in a practical way:

One way of ensuring that a user does not share his/her password/account with anyone else, could be to add a setting that actually sends out a temporary link that must be used to be allowed to kick out the other session. That will ensure that only that user can kick him/herself out. The link will be sent to that user's email, and when used followed by a successful login, then the previous session is replaced with the new one.

Leeteq’s picture

One particularly practical use case for the above is sites that require paid subscriptions to access the site or certain parts of it. In those cases, it is a concern to prevent people sharing their account.

Obviously this does not make a fool proof solution, but will help keep such "abuse" of terms to a "minimum" without significant cost.

Leeteq’s picture

Ah, and further on that - since many of us use 2-3 computers - home, laptop, work, etc., that module should still allow a setting of x active sessions per user. Each requiring such a one-time link to "register it".

Would be perfect if admins could set one such limit per role, using the highest number for users that are members of serveral roles.

The session_limit should then only delete the oldest session for that user once that threshold is reached.

I believe this will be a very useful module for a lot of sites.
Could even help "sell"/promote Drupal by itself.

drawk’s picture

Number of sessions per role would be an interesting feature .. probably worth the creation of a separate issue as a feature request.

I don't see myself having a need for it, and am unlikely to code it myself short of a bounty.

Zen’s picture

StatusFileSize
new1.81 KB

Patch for 5.

IMO, this should be the default behaviour for this module.

Thanks.

Zen’s picture

Version: 4.7.x-1.x-dev » 5.x-1.x-dev
Status: Active » Needs review

Changing status + version.

deekayen’s picture

Status: Needs review » Fixed
Anonymous’s picture

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.