Btukfyl

I recently went to an interview and they asked me this question. I wasn't prepared for this, i just simply bought up database into it because that's what i do when i can't find solution even though i known it's bad programming. I told them to make a extra column as "status" in user's table so as user logs in from one browser the status should be changed and if again he tries to login from other browser we should check the user is already logged in or not to avoid multiple login from different browser. He doesn't seemed impressed (i wasn't expecting either). He asked me how to do it using spring security? I actually have no idea. Can someone please give me answer and optimized solution with example. Please i need it.

The solution is supported out of the box using spring security.

From the Spring documentation:

Concurrent Session Control

If you wish to place constraints on a single user's ability to log in to your application, Spring Security supports this out of the box with the following simple additions. First you need to add the following listener to your web.xml file to keep Spring Security updated about session lifecycle events:

<listener>

  <listener-class>

    org.springframework.security.web.session.HttpSessionEventPublisher

  </listener-class>

</listener>

Then add the following lines to your application context:

<http>

  ...

  <session-management>

      <concurrency-control max-sessions="1" />

  </session-management>

</http>

This will prevent a user from logging in multiple times - a second login will cause the first to be invalidated. Often you would prefer to prevent a second login, in which case you can use

<http>

  ...

  <session-management>

      <concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />

  </session-management>

</http>

The second login will then be rejected. By “rejected”, we mean that the user will be sent to the authentication-failure-url if form-based login is being used. If the second authentication takes place through another non-interactive mechanism, such as “remember-me”, an “unauthorized” (402) error will be sent to the client. If instead you want to use an error page, you can add the attribute session-authentication-error-url to the session-management element.

If you are using a customized authentication filter for form-based login, then you have to configure concurrent session control support explicitly. More details can be found in the Session Management chapter.