Invalidating active session if a user logs in from another location

RE: RE: Invalidating active session if a user logs in from another location

2025-01-22T14:14:49Z

This indeed works as expected. It needs to be complemented by enabling tracking active sessions, which I remember was discouraged because of performance, but our community is not so large so it is acceptable.

RE: Invalidating active session if a user logs in from another location

2025-01-22T14:11:18Z

Hi Jan,

Doesn't setting the auth.simultaneous.logins property to false covers this request?

See https://github.com/liferay/liferay-portal/blob/master/portal-impl/src/portal.properties#L3480

Regards,
Zsigmond

Invalidating active session if a user logs in from another location

2024-12-03T11:40:31Z

Description
It is possible to log in to the application from multiple locations under the same user account simultaneously.

Impact

Unauthorized Access: Concurrent logins make it difficult to distinguish between legitimate and unauthorized access. An attacker gaining access to the account can operate from a different location, complicating detection.
Account Compromise: If one set of credentials is compromised, the attacker can access the account concurrently with the legitimate user, potentially leading to unauthorized activities.
Monitoring Challenges: Tracking user activities becomes more challenging, making it harder to identify suspicious behavior or potential security incidents