Single session per user
-
In FusionAuth, how can I limit the number of concurrent sessions to a single session per user?
-
@mike-rudat Currently, there's no built-in single session solution. However, this can be implemented and managed via webhooks.
When a user logs in a webhook fires. In response to that webhook one can then revoke existing refresh tokens issued to the user previously. Webhooks can be enabled via FusionAuth Admin UI->Tenants->Webhooks. A good place to start would be user.login.success.
Here is the documentation for webhooks and revoking JWT's.
https://fusionauth.io/docs/apis/webhooks
https://fusionauth.io/articles/tokens/revoking-jwtsThis may require a decent amount of consideration when SSO is enabled and there are multiple applications a user can be logged into. You will have to iterate through that user's existing issued JWT's and logically determine which ones to revoke.
-
@mike-rudat This might be of interest too: https://fusionauth.io/docs/extend/examples/device-limiting
