# Prevent multiple User "usage"

**URL:** <https://discourse.cakephp.org/t/prevent-multiple-user-usage/2545>\
**Category:** Need Help\
**Created:** [May 9, 2017, 10:03am UTC](https://discourse.cakephp.org/t/prevent-multiple-user-usage/2545 "2017-05-09T10:03:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![andrekat](https://avatars.discourse-cdn.com/v4/letter/a/eb9ed0/32.png) [@andrekat](https://discourse.cakephp.org/u/andrekat)\
**Post date:** [May 9, 2017, 10:03am UTC](https://discourse.cakephp.org/t/prevent-multiple-user-usage/2545/1 "2017-05-09T10:03:33Z")

</div>

Hello!

I am trying to prevent multiple logins with the same user (e.g. user sharing).

To solve this problem i attached a column to my users table “session\_id” (nullable, FK to sessions table) which will be filled after login.

```
if($this->UserUtil->hasActiveSession(($user['id']))) {
                    $this->Flash->error(_('Der Benutzer ist bereits angemeldet!'));
                } else {
                    $this->Auth->setUser($user);

                    $this->request->session()->delete('user.active_channel');

                    $this->UserUtil->setSession($user['id'], $this->request->session()->id());

                    return $this->setAction('dashboard');
                }

```

Using an custom SessionHandler (extend DatabaseSession) I extended the “destroy” function to clear the session\_id field on an users entry:

```
// Destroy a session.
public function destroy($id)
{
    $usersTable = TableRegistry::get('users');
    $users = $usersTable->find()->where(['session_id' => $id]);

    if($users->count() > 0) {
        foreach($users as $user) {

            $user->session_id = null;
            $usersTable->save($user);

        }
    }

    return parent::destroy($id);
}

```

This solution works fine except the first request after login --\> i am getting an FK violation error. Somehow i refresh the early sent request, the session\_id will be correctly stored in the users entry.

I dont have an idea where the problem lies, do you?

---

<div class="post-metadata">

**Author:** ![steinkel](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/steinkel/32/56_2.png) [@steinkel](https://discourse.cakephp.org/u/steinkel)\
**Post date:** [May 12, 2017, 10:03am UTC](https://discourse.cakephp.org/t/prevent-multiple-user-usage/2545/2 "2017-05-12T10:03:06Z")

</div>

Hi, I would suggest to enable query logging in the Datasource configuration (app.php) and check the sequence of the queries generated to be able to debug the specific fk violation error. Bin your log here if you get stuck to take a look… Thanks,

---

<div class="post-metadata">

**Author:** ![andrekat](https://avatars.discourse-cdn.com/v4/letter/a/eb9ed0/32.png) [@andrekat](https://discourse.cakephp.org/u/andrekat)\
**Post date:** [May 12, 2017, 10:05am UTC](https://discourse.cakephp.org/t/prevent-multiple-user-usage/2545/3 "2017-05-12T10:05:40Z")

</div>

thanks for your answer. i figured out that there is a session\_id regeneration after sign in? dont know where is the right point to insert it to my users table. i have finally decided to remove the FK check in users table on the session\_id column. it may be a bad workaround, but it works fine.

**solved**