Webapp2 - Invalidate user login session, when the user logs in from a different browser
Make modification to what you already do: when user logs in, create unique/random token and store it in the user object and set a cookie in the browser with it. When user's session is requested, check that the two tokens (from the request cookie and user object) match and if not, burn the session.
It's just the same but instead of remote_addr use a random token that you generate and set as cookie on login.
I have the following requirement in a webapp2 application. When a user leaves his machine or browser, that user's previous authentication session should be terminated.
I am able to do this when a user logs in from a different machine, by storing the remote_addr in the User object at login. When the user's session is requested I check the remote_addr from the request against the user's remote_addr at login.
I am not happy with this solution, as it will not work when the user is behind a proxy server and also, it will not work when the user uses different browsers.
Does webapp2 store a session id somewhere, so I can use that to see if the user has logged on in a new session?