Webapp2 - Invalidate user login session, when the user logs in from a different browser
When you open a website for the first time in a browser session a site session is created.
When he logs in you just store the session id in the database.
You need to have a nice table with active logins.
You can also set a cookie in his browser if you want to keep him logged in if he closes and restarts the browser later.
Obviously if the cookie exists modify the session id to the one in the cookie.
Cookies are not shared between browsers so in this case if he logs in from a new browser you changes the session id in the active logins table.
Also you need to have a small ajax that checks if current session is still active every 5 min or so and logs him out if not.
I have the following requirement in a webapp2 application. When a user leaves his machine or browser, that user's previous authentication session should be terminated.
I am able to do this when a user logs in from a different machine, by storing the remote_addr in the User object at login. When the user's session is requested I check the remote_addr from the request against the user's remote_addr at login.
I am not happy with this solution, as it will not work when the user is behind a proxy server and also, it will not work when the user uses different browsers.
Does webapp2 store a session id somewhere, so I can use that to see if the user has logged on in a new session?