<p>There's no built-in Craft functionality to restrict concurrent logins at present.</p>
<p>When I've needed to implement this functionality, I've built a module to prevent concurrent logins which listens to the <code>EVENT_BEFORE_LOGIN</code> event and checks in a custom table for an active login record for the user. If there's fewer records than the desired limit for concurrent logins, a new session record is added to the custom table and the user can log in successfully.</p>
<p>If there's more than the desired limit for concurrent logins for that user in the table, it sends an email alert to the user to let them know they've reached the limit for concurrent logins, removes all of their login records from the custom table and logs them out of all of their previous sessions by deleting their records from the Craft <code>sessions</code> table using the following command:</p>
<pre><code>Craft::$app-&gt;getDb()-&gt;createCommand()
    -&gt;delete(Table::SESSIONS, [
        'userId' =&gt; $userId,
    ])
    -&gt;execute();
</code></pre>
<p>This was developed to mitigate login sharing amongst users, so it always allows the current login session to continue but removes all others if the current login session breaches the desired concurrent logins limit. This means that the user logging in is never blocked from accessing the site/CP but anyone else who might be piggy-backing onto their user account at the same time is logged out automatically.</p>
<p>If it helps, I can post some more code here to get you started if you want to follow a similar route.</p>

CC BY-SA 4.0
2022-08-24T13:37:09.523Z
That's okay, thanks Martin that's super helpful. Sounds like your Module would make a very useful plugin!
Ian Nebbiolo
CC BY-SA 4.0
2022-08-24T15:34:46.053Z
It's crossed my mind to turn it into a proper plugin. One day when I have a bit more time to tidy it up, perhaps! Glad I could help.
Martin Spain
CC BY-SA 4.0
2024-06-18T15:39:00.320Z
I need this functionality for a client. Do you know if a plugin exists? Or are you able to share more code?
user974590
CC BY-SA 4.0
2022-08-24T09:14:30.940Z
2022-08-24T13:00:53.880Z
2022-08-24T13:00:53.880Z
Martin Spain
<p>Is there a way to prevent the same user having multiple concurrent active sessions? Specifically if a user has logged into Craft's CP in one browser, but logs in on other browser/device, can we automatically invalidate the previous session and log the user out?</p>
<p>I've checked through the <a href="https://craftcms.com/docs/4.x/config/config-settings.html#session" rel="nofollow noreferrer">General Config Settings</a> in the docs and can't find anything that would enable this behaviour.</p>

<users><config>
Prevent concurrent user logins/sessions
# Prevent concurrent user logins/sessions

(Asked by: username_0 on 2022-08-23)

Is there a way to prevent the same user having multiple concurrent active sessions? Specifically if a user has logged into Craft's CP in one browser, but logs in on other browser/device, can we automatically invalidate the previous session and log the user out?

I've checked through the [General Config Settings](https://craftcms.com/docs/4.x/config/config-settings.html#session) in the docs and can't find anything that would enable this behaviour.

**Tags:** users, config


---

## 1 answers

### Answer by username_1 on 2022-08-24. Score: 2 | Accepted answer

There's no built-in Craft functionality to restrict concurrent logins at present.
When I've needed to implement this functionality, I've built a module to prevent concurrent logins which listens to the EVENT_BEFORE_LOGIN event and checks in a custom table for an active login record for the user. If there's fewer records than the desired limit for concurrent logins, a new session record is added to the custom table and the user can log in successfully.
If there's more than the desired limit for concurrent logins for that user in the table, it sends an email alert to the user to let them know they've reached the limit for concurrent logins, removes all of their login records from the custom table and logs them out of all of their previous sessions by deleting their records from the Craft sessions table using the following command:
Craft::$app->getDb()->createCommand()
    ->delete(Table::SESSIONS, [
        'userId' => $userId,
    ])
    ->execute();

This was developed to mitigate login sharing amongst users, so it always allows the current login session to continue but removes all others if the current login session breaches the desired concurrent logins limit. This means that the user logging in is never blocked from accessing the site/CP but anyone else who might be piggy-backing onto their user account at the same time is logged out automatically.
If it helps, I can post some more code here to get you started if you want to follow a similar route.

> **Comments:**
> **username_0**: That's okay, thanks Martin that's super helpful. Sounds like your Module would make a very useful plugin!  
> **username_1**: It's crossed my mind to turn it into a proper plugin. One day when I have a bit more time to tidy it up, perhaps! Glad I could help.  
> **username_2**: I need this functionality for a client. Do you know if a plugin exists? Or are you able to share more code?  

---

