I don't use PHP's built in session management. Instead, I wrote my own routines that do the following:
1) Initial URL goes to the login screen.
2) When user logs on, validate userid and password. Store Userid, IP ADDRESS of client, and current/date time in a table somewhere that has a unique ID number (ie, the session cookie)
2a) Before doing #2, validate that no entries exist in this session table for the userid that is trying to logon. If one does exist (and has not timed out), I invalidate the OLD session and allow user access.
3) Send the new session cookie to the client
Now, with each page movement, call a routine that:
- Validates that the session ID (ie, cookie) still exists in the database and that the date/time is within your timeout limits.
- Validate that the IP address of the client matches the IP address in the database
- Update the date/time for this access.
You can also pass the userid as a cookie as well for a third check in #2 above.
Any failures should redirect to login screen.
So, if the user exits their browser, they'll loose the session cookie.
Moreover, if the same user tries to logon again, #2a will be invoked. You'll have to determine the business rule of whether a) They're allowed in and their old session is terminated or b) They're bounced until their old session expires.
Hope this helps.
