当前位置: 动力学知识库 > 问答 > 编程问答 >

java - How to ensure the same account is not used to log in two different people at the same time in Spring Security?

问题描述:

I have a Spring MVC app that does not protect updates of user data with transactions.

It assumes that only a single user is accessing the account data for that account at any one time.

However, if two users were to log in using the same authentication credentials, it is theoretically possible, although unlikely, for two database updates on the same user data to overlap and conflict.

Is there a simple way to protect against this in Spring Security?

网友答案:

Spring Security supports protection against concurrent logins. See 2.3.3 Session Management for instructions of how to enable it.

网友答案:

Add a column to the user database called "logged in". If that value is set, then refuse a second login.

网友答案:

The answer from Aaron Digulla is the best one. The suggestion from BalusC is not good because if someone steals your login credentials then he can gain access to the system and the legitimate user will be logged out. If that person is meant for evil then he can change the password and the legitimate user can't access his/her account anymore.

The best way is what Aaron suggested.

分享给朋友:
您可能感兴趣的文章:
随机阅读: