Re: Concurrent Sessions and User Feedback

The way we handle this in some of our applications is the following:

1. If they successfully log in with a valid password and username then the message should allow them to kill off the other session. If the uname or password isn't valid see the next entry.
2. If the account is locked out, invalid, suspended, or non-existant you should give basically the same message. Something along the lines of "login is invalid, if you are having trouble please contact support at ...."

Hope this helps,
-gabe

Susan Olson wrote:

>I'm looking for words of wisdom/advice/ideas on how to handle this from a security/"best practices" perspective.
>
>Basically, I am evaluating a web application that disallows concurrent sessions; it only allows for one unique logon session to occur at the same time using just one username/password combination.
Received on Sat Apr 5 16:08:26 2003