Allowing only single active session per user in Django app

Question

I want to restrict logged-in users to only have one active session, i.e. if the user logs in with a new sessionid, the old session should be terminated. I found a lot of help on SO already: here and here

I implemented the middleware solution, with a bit of extra checking...

class OnlyOneUserMiddleware(object):
"""
Middleware to ensure that a logged-in user only has one session active.
Will kick out any previous session. 
"""
def process_request(self, request):
    if request.user.is_authenticated():
        try:
            cur_session_key = request.user.get_profile().session_key
            if cur_session_key and cur_session_key != request.session.session_key:
                # Default handling... kick the old session...
                Session.objects.get(session_key=cur_session_key).delete()
            if not cur_session_key or cur_session_key != request.session.session_key:
                p = request.user.get_profile()
                p.session_key = request.session.session_key
                p.save()
        except ObjectDoesNotExist:
            pass

So far, so good... on the Django dev server (manage.py runserver) everything works properly, it kicks the old session...

...but when using Apache ( with mod_wsgi), it doesn't work!

I've tried to find any information about this, but no luck so far...

The closest I have found is this, but it is kind of the 'opposite' problem...

Any help would be much appreciated.

Edit: I added a debug print before deleting the Session... here's a snippet from Apache's error.log:

[Fri Jan 20 09:56:50 2012] [error] old key = f42885ccb7f33b6afcb2c18fca14f44a
[Fri Jan 20 09:56:50 2012] [error] new key = ce4cfb672e6025edb8ffcd0cf2b4b8d1
[Fri Jan 20 09:57:14 2012] [error] old key = f42885ccb7f33b6afcb2c18fca14f44a
[Fri Jan 20 09:57:14 2012] [error] new key = 0815c56241ac21cf4b14b326f0aa7e24

the first two lies are from when I entered with the first session (Firefox)

the last two are from when I entered with the second session (Chromium)

... it turns out that the old Session record does not get deleted... ???

I'm running vs. the exact same PostgreSQL instance as I did with the devserver...

Edit2: It turned out that my code was buggy... it failed when the new Session_key wasn't found in Session...

here's the fixed code... the try..except is now in the correct place

class OnlyOneUserMiddleware(object):
    """
    Middleware to ensure that a logged-in user only has one session active.
    Will kick out any previous session. 
    """
    def process_request(self, request):
        if request.user.is_authenticated():
            cur_session_key = request.user.get_profile().session_key
            if cur_session_key and cur_session_key != request.session.session_key:
                # Default handling... kick the old session...
                try:
                    s = Session.objects.get(session_key=cur_session_key)
                    s.delete()
                except ObjectDoesNotExist:
                    pass
            if not cur_session_key or cur_session_key != request.session.session_key:
                p = request.user.get_profile()
                p.session_key = request.session.session_key
                p.save()

When you say "doesn't work", what exactly isn't working? You still see the old session in the DB? If you put a print/logging call just before the `Session` delete, do you see that executed under `mod_wsgi`? — AdamKG, Jan 19 '12 at 14:14
If session engine is cache_db, I think we also need to remove sessionkey from cache manually, right? — Wesley, Aug 26 '16 at 05:43

score 3 · Answer 1 · answered May 07 '15 at 19:47

There is indeed a lot of similar questions all over the place, but here is my solution.

When a user logins go over all active sessions and remove the ones with the same user.id. For smaller websites, this should do just fine.

# __init__.py
# Logs user out from all other sessions on login, django 1.8

from django.contrib.sessions.models import Session
from django.contrib.auth.signals import user_logged_in
from django.db.models import Q
from django.utils import timezone

def limit_sessions(sender, user, request, **kwargs):
    # this will be slow for sites with LOTS of active users

    for session in Session.objects.filter(
        ~Q(session_key = request.session.session_key),
        expire_date__gte = timezone.now()
    ):
        data = session.get_decoded()
        if data.get('_auth_user_id', None) == str(user.id):
            # found duplicate session, expire it
            session.expire_date = timezone.now()
            session.save()

    return

user_logged_in.connect(limit_sessions)

Have you compared the performance between the two ways? I mean, way through signals and middleware. If use middleware, all requests should go through the handle_request. If use signals, although only login event hit the function, but it will iterate over session table... so, think about performance, which is better... — Wesley, Aug 26 '16 at 02:42
i did say "for smaller websites" :) - you might want to store the key like OP does but only check it at login as I do for a more performant solution — MarZab, Aug 26 '16 at 07:41
Yeah, I see you mentioned for smaller websites :-) I just wanna know what's better for larger sites :-) — Wesley, Aug 27 '16 at 07:50

score 1 · Answer 2 · answered Jan 26 '12 at 02:31

You can always use this approach though not recommended, it works.

my_old_sessions = Session.objects.all()
for row in my_old_sessions:
   if row.get_decoded().get("_username") == request.user.username:
      row.delete()

You would implement the code above in your login() function right before authenticating the user.

This of course only works if you have a login() function method that stores the USERS username in his session like follows:

request.session["_username"] = request.user.username

If you use this approach just remember to empty your database of all of your sessions before running your server after you've made these changes because it will raise KeyLookUp errors.

_username is not longer in a session object's get_decoded() (Django 1.8). However, user_id is, so `row.get_decoded().get("_auth_user_id") == request.user.pk` would work. — gdvalderrama, Jan 02 '17 at 09:01

score 0 · Answer 3 · answered Aug 31 '16 at 17:32

0

I feel that, somehow, django.contrib.auth signals could help here. On login, invalidate older user sessions.

answered Aug 31 '16 at 17:32

Italo Maia

1,956
3
18
31

If you're already working with a user database, this would mean all users would have to be logged out first for this to work. – gdvalderrama Jan 02 '17 at 08:58

Allowing only single active session per user in Django app

3 Answers3

Linked

Related