0

I've searched all of google and stackoverflow for this, but with no success. I'm starting to feel the simple answer to this question is "no", but I haven't been able to confirm this either.

Is there a way to limit apache to 1 session per authenticated user?

Say I'm logged in as admin1 (using .htaccess and .htpasswd). Is there a way to stop another user from also logging in as admin1 as long as I am connected?

1 Answers1

0

Basic authentication by itself has no concept of a user session, and the HTTP protocol is stateless without such a concept. As such, there is no concept of "connected". You might however be able to use mod_auth_form - http://httpd.apache.org/docs/current/mod/mod_auth_form.html - to provide a session-backed basic authentication. I don't know that there is any provision for limiting a single session per login though. Chances are you need to do this in the application layer.

Mike Brant
  • 70,514
  • 10
  • 99
  • 103