First of all, this is a really great auth system .
I've got a question, wondering if you can help me.
I want a user to be able to open only ONE session. So if he is logged in with firefox and tries to login with IE it should log him out from firefox and leave the IE session open.
Is there any method which would help me archiving this ?
I could maybe check if the ip address in combination with the browser exists in the database, if not login user out? Would that approach be reliable enough ? But then we know the ISP sometimes changes the ip address and the user might get kicked out randomly on ip change.
Another session issue. If the User hasn't ticket "remember me" and closes his browser the app should automatically log him out. How would you archive this ?
. 