The same user can only login once

Question

Hello,
I have a problem with my system. I made a system where you must login.
I use the following code:
boolean login = false;
String username= request.getParameter("username");
String password= request.getParameter("password");
User user= Usermutations.makeviaUsername(username);
if (user.getPassword().equals(password) && !password.equals("")) login= true;
if (login) ReqD = getServletContext().getRequestDispatcher("/Overview.jsp");
else ReqD = getServletContext().getRequestDispatcher("/False.jsp");
request.getSession().setAttribute("user",user);
request.getSession().setAttribute("username",username);
request.getSession().setAttribute("password",password);
if (ReqD != null) ReqD.forward(request,response);
//Clean up resources
public void destroy()
Now I want that the same user can only login once. So when a user login with his username and password, no one else can login with that user name and password.
I don't wan't to put the username in the database and then validate if the user is already logged in, because then the user must logout and not close the webbrowser else the user stays in the system.
Does anyone knows a solution top this problem.
Thanks in advance,
Henk

Answer 1

So I wan't the database and when the user is logged in
the name is set in the database. But when the user
clicks on the X (close button in the browser his
username must be deleted from the database)You can't tell when the user does that (or perhaps you can sometimes, with difficulty). But even if you could it doesn't solve your problem. Many people keep their browsers open all day, and -- you may find this shocking -- they go to sites other than yours.
So basically, if you don't provide them with a logout button you can't tell when they "leave" your site. And even if you do provide them with a logout button, they won't necessarily bother to use it. So you're left with waiting until the session expires, and then logging them out. This also means that if they come back to your site while the session is still active, then they are still logged in. This is not an error and you should not treat it as one.
PC²