How to restrict multiple logins

ℹ️ Support
1

Is there a way to restrict multiple logins for a user across different or same device??

1 Like
2

Yes, it is possible to restrict multiple logins for a user across different or the same device. This can be done by implementing session management techniques, such as:

  1. Session Limiting: Allow only one active session per user at a time.
  2. Device Fingerprinting: Track unique device identifiers (e.g., IP address, browser fingerprint) to limit login to specific devices.
  3. Token-based Authentication: Use tokens (JWT, OAuth) and ensure they are valid only for a single session or device.
  4. Real-time Monitoring: Monitor login attempts and revoke sessions if multiple logins are detected.

These methods help enforce single login access and prevent simultaneous logins from multiple devices or locations.

3

Thanks for info

Can u please outline steps to implement Session Limiting or any other above mentioned techniques.

4

With file access control (File access control - Apps - App Store - Nextcloud), you can realize certain restrictions (e.g. access content just via certain ip ranges, time of the day, …).

A session limit like this is not implemented (as far as I know), the problem is that generally you do have multiple sessions per user. For example if you sync your mobile, you have a connection for the app, then you have a connection for the calendar, and a connection for contacts. Nextcloud is a solution to sync data between devices, so why blocking its main feature?

5

What do you consider to be “multiple logins”?

Two (distinct) browsers on the same device that happen to be logged in?

And when do you consider a session to be “active” versus inactive? Does it have to be logged out/timed out first? etc.

We might be able to provide specific suggestions if you give us more context about the broader problem you’re attempting to solve.

1 Like
6

Multiple login means user is already logged in on same or different device & not logged out yet.

7

Have you already looked at all the configuration options as described → here ← , especially the directives

  • 'remember_login_cookie_lifetime', which is 15 days by default and can be set to 0
  • 'session_lifetime' defaults to 24 hours if the php garbage collector is not set to a shorter period (on Debian systems this is every 30 minutes by default)
  • 'session_relaxed_expiry' can be set to true so that the php garbage collector or another configured backend (e.g. redis) takes over the expiration
  • 'session_keepalive' is set to true by default, if this is set to false there is no longer a controlling heartbeat
  • 'auto_logout' can be set to true so that an inactive session is automatically logged out, even if ‘session_keepalive’ is set to true

h.t.h.

Much and good luck,
ernolf

1 Like