java - java中如何防止在不同设备上使用相同凭据多次登录

Question

我有一个要求:我需要防止在不同设备上使用相同凭据进行多次登录，即注销以前的登录用户并允许新用户登录。

假设 user_A 已登录，然后 user_B 尝试使用与 user_A 相同的凭据登录应用程序，然后注销 user_A 并允许 user_B 登录。我用 servlet 和 session 尝试过此操作，但无法解析。

提前致谢。

Answer 1

您需要有应用程序范围的概念。

当用户登录时，只需将他注册为在此应用程序范围上下文中登录(例如，如果您使用 jsf/cdi，您可以将其存储在 @ApplicationScoped 或 @ 中单例 bean)

此示例假设您正在定义自己的上下文。

//Application scoped.
//You need also more or less make it singleton
public enum MyApplication{
  CURRENT_APPLICATION;

  public void onLogin(MyUser user, HttpSession session){}
  public MyUser getCurrentUser(HttpSession session) {}
  public boolean isLoggedIn(MyUser user){} //logged in on any session
  public boolean isLoggedIn(MyUser user, HttpSession session){} //logged in on this session
  public void logoutUser(MyUser user){} //logs out the user in any session
}

public class MyServlet extends HttpServlet{
  //somewher in do get or post
  private void login(String username, String password) {
    MyUser user = findUser(username, password);
    boolean loggedInAnotherSession = MyApplication.CURRENT_APPLICATION.isLoggedInUser(user);
    //logout the user from the other session or something like that
    boolean loggedInOnThisSession = MyApplication.CURRENT_APPLICATION.isLoggedInUser(user, getSession()); //session from http request
    //logout the user if the he is loggedin in a different session other than this
    if(!loggedInAnotherSession || !loggedInOnThisSession){
      //user is either logged in a different session or not logged in at all.
      //login the user
      MyApplication.CURRENT_APPLICATION.onLogin(user, getSession());
    }
  }
}