How to prevent multiple logins by using HttpBindingListener

Question

Hi,
Can anyone tell me how do i actually use session to prevent multiple login from different machine? From my understanding, i need to use HttpBindingListener to valueBound and valueUnbound when user tries to login, but i encounter a problem is my session is always overwritten since i use setAttribute() method in servlet.
For instance i use username(aaa & bbb) to login in two different machine, my login is always overwritten if i use username bbb to login after username aaa. i know it is because setAttribute() method overwrite existing session data, so i would like to know what other method should i use to achieve what i want, tks.

Answer 1

Hi,
This is the logic for session :
Connect to db for verification, once verified, system return a UserBean and this UserBean will be set in ClientSecurityEngine
When this particular user has been successfully verified, a new session will be created
if(success)
    session = request.getSession();
    User user;
    synchronized(session)
    user = (User) session.getAttribute("user");                       
    if(user == null)
       user = new User(ClientSecurityEngine.getInstance().getUserBean().getUsername());
       session.setAttribute("user", user);
/* User class */
public class User implements HttpSessionBindingListener {
    private static Map<String, HttpSession> logins = Collections.synchronizedMap(new HashMap<String, HttpSession>());
    private String username;
    public User(String username) {
        this.username = username;       
    public String getUsername() {
        return username;
    @Override
    public void valueBound(HttpSessionBindingEvent event) {
        if (logins.containsKey(getUsername())) {
            HttpSession session = logins.remove(getUsername());
            if (session != null) {
                session.invalidate();
            logins.put(getUsername(), event.getSession());
        } else {
            logins.put(getUsername(), event.getSession());
    @Override
    public void valueUnbound(HttpSessionBindingEvent event) {
        logins.remove(getUsername());
}Edited by: EJP on 21/07/2011 14:22: added {noformat}{noformat} tags so we can actually read your code. Please use them.