Package: django-single-session
Django-single-sessionA Django app that enforces that a user has only one active session: if the user logs in on another browser/device, then the previous sessions will log out.The app will also add an extra action to theModelAdminof the user model (if there is suchModelAdmin), that will alow to log out all sessions of a given (set of) user(s).InstallationThe package can be fetched asdjango-single-session, so for example withpipwith:pip3installdjango-single-sessionOne can install the app by adding thesingle_sessionapp to theINSTALLED_APPSsetting:# settings.py# ...INSTALLED_APPS=[# ...,'django.contrib.sessions',# ...,'single_session'# ...]MIDDLEWARE=[# ...,'django.contrib.sessions.middleware.SessionMiddleware',# ...,'django.contrib.auth.middleware.AuthenticationMiddlware',# ...]SESSION_ENGINE='django.contrib.sessions.backends.db'For theSESSION_ENGINEsetting, the database backend,django.contrib.sessions.backends.dbshould be used, since that is the one where the item is linking to.In order to work properly, theSessionMiddlewareandAuthenticationMiddlewarewill be necessary, or another middleware class that will add a.sessionand.userattribute on the
request object and will trigger theuser_logged_inanduser_logged_outsignals with the proper session and user.and runningmigrateto migrate the database properly:python3manage.pymigratesingle_sessionThis will by default enforce that a user will only haveonelogged in session. This willnotproactively logout existing sessions: only if the user logs in with another browser or device,
the old session(s) will be closed.ConfigurationOne can disable the single session behavior by settingSINGLE_USER_SESSIONinsettings.pytoFalse(or any other value with truthinessFalse).You can customise this behaviour by making theSINGLE_USER_SESSIONsetting be a string representing the name of a function which takes a user object as an argument. If this function returnsTruethen the user will be logged out. If it returnsFalsethen the user will not be logged out.The tool will also clean upallsessions of a user in case that user logs out. This thus means that if a user logs out on one browser/device, they will log out on all other browsers/devices as well. This functionality is still enabled ifSINGLE_USER_SESSIONis set toFalse. You can disable this by setting theLOGOUT_ALL_SESSIONSsetting insettings.pytoFalse(or any other value with truthinessFalse).Logging out (other) usersIf there is aModelAdminfor the user model (if you use the default user model, then there is suchModelAdmin), and thedjango.contrib.adminpackage is installed,
then thatModelAdminwill have extra actions to log out normal users and admin users.You can thus select users, and log these out with the "Log out the user on all sessions" action. This will invalidate all the sessions for (all) the selected user(s). In order to do this,
thesingle_session.logoutpermission is required, so only admin users and users with such permission can log out other users. Users with such permission can log out users, butnotadmin users.There is an extra permission namedsingle_session.logout_allto log out all users, includingadminusers. Users with such permission can thus also log out admin users, so it
might be better not to give such permission to all (staff) users.Contributors@alastairimplemented a system such that one can add a string that points to a callback for theSINGLE_USER_SESSIONsetting, to make it possible to determine what users should be logged out.