pbmedia/laravel-single-session

Prevent a User from being logged in more than once

Laravel Single Session

, _(*1)

This package prevents a User from being logged in more than once. It destroys the previous session when a User logs in and thereby allowing only one session per user. It assumes you use Laravel's Authentication features., _(*2)

Requirements

• Laravel 5.6 only, 7.1 and 7.2 supported.
• Support for Package Discovery.
• Support for Laravel Passport.

Notes

• Laravel 5.6.14 and later supports invalidating sessions out-of-the-box.
• If you're still using Laravel 5.5, please use version 1.2.0.

Installation

You can install the package via composer:, _(*3)

``` bash composer require pbmedia/laravel-single-session, <sub>(*4)</sub>

Publish the database migration and config file using the Artisan CLI tool.

``` bash
php artisan vendor:publish --provider="Pbmedia\SingleSession\SingleSessionServiceProvider"

The database migration adds a session_id field to the users table. Run the migration to get started!, <sub>(*5)</sub>

``` bash php artisan migrate, <sub>(*6)</sub>

Now add the ```\Pbmedia\SingleSession\Middleware\VerifyUserSession``` middleware to the routes you want to protect.

## Usage

Since Laravel 5.5 has support for Package Discovery, you don't have to add the Service Provider to your ```app.php``` config file.

In the ```single-session.php``` config file you can specify a ```destroy_event```. This event will get fired once a previous session gets destroyed. You might want to use this to [broadcast](https://laravel.com/docs/5.6/broadcasting) the event and handle the destroyed session in the user interface. The constructor of the event can take two parameters, The User model and ID of the destroyed session. Here is an example event:

```php
<?php

namespace App\Events;

class UserSessionWasDestroyed
{
    public $user;
    public $sessionId;

    public function __construct($user, $sessionId)
    {
        $this->user = $user;
        $this->sessionId = $sessionId;
    }

    public function broadcastOn()
    {
        // return new PrivateChannel('channel-name');
    }

    public function broadcastWith()
    {
        return ['user_id' => $this->user->id];
    }
}

When using Laravel Passport it automatically prunes and revokes tokens from the database as well. This can be disabled by setting the prune_and_revoke_tokens option to false in the config file., <sub>(*7)</sub>

If you're using Laravel Passport's CreateFreshApiToken middleware, add the Pbmedia\SingleSession\Middleware\BindSessionToFreshApiToken middleware before the CreateFreshApiToken and add the VerifyUserSessionInApiToken middleware to the auth:api group:, <sub>(*8)</sub>

$router->get('/', 'HomeController@show')->middleware([
    'web', 'auth', BindSessionToFreshApiToken::class, CreateFreshApiToken::class
]);

$router->get('/api', 'ApiController@index')->middleware([
    'api', 'auth:api', VerifyUserSessionInApiToken::class
]);

Changelog

Please see CHANGELOG for more information what has changed recently., <sub>(*9)</sub>

Testing

bash $ composer test, <sub>(*10)</sub>

Contributing

Please see CONTRIBUTING for details., <sub>(*11)</sub>

Security

If you discover any security related issues, please email pascal@pascalbaljetmedia.com instead of using the issue tracker., <sub>(*12)</sub>

Credits

• Pascal Baljet
• All Contributors

License

The MIT License (MIT). Please see License File for more information., <sub>(*13)</sub>