Customers Login Issues

**tajul_ashyqin** · 6 Dec 2006, 03:58 AM

Hi Zen Cart Team,

I am wondering how to prevent a customer from logging into their account more than once at the same time as currently a customer can login from different computers within the same time. I just want to prevent if a customer A login to their computer from computer A, he/she cannot login to his/her account from computer B with the same account!

**Kim** · 6 Dec 2006, 04:09 AM

Why do you need to do this?

**tajul_ashyqin** · 6 Dec 2006, 05:07 AM

actually, I need this kind of prevention as requested by one of my client! Is it possible, Kim? I really need this kind of customization...

**BlindSide** · 6 Dec 2006, 05:08 AM

What about the IP Address check, would that help?

Admin > Configuration > Sessions > Check IP Address

/edit: if that doesn't work, I do have a customization idea you can try...

**tajul_ashyqin** · 6 Dec 2006, 05:23 AM

thanx Blindside but its not working!

I think that option is for another purposes...so, what is the another option?!

**Ajeh** · 6 Dec 2006, 06:00 AM

There are draw backs to attempting this ...

1 for testing purposes it is a problem as a store owner/staff to test various aspects ... this would make testing sites yourself or with others a real problem

2 if the customer loses the connection ... now they cannot login for at least 24 minutes ... this will upset a lot of customers

**BlindSide** · 6 Dec 2006, 02:45 PM

For #1, he could have an exception rule for specifically assigned IP's, similar to the "down for maintenance" setup.

For #2, what's to stop him from shortening the expiration on Zen sessions? Even still, this may be an issue for customers who use services like AOL, who get routed through a myriad of proxy's and may change IP's in the middle of browsing.

If you still want to try this (and I'll emphasize that Linda's concerns are very valid), here's what you can do in simple terms...

Make sure you store is set to store sessions in the DB. In the catalog-side configure.php...
Code:
```
define('STORE_SESSIONS', 'db');
```
Edit the login scripting to include the customers_id. You'll need to look at the login page and associated functions.
Whenever a login attempt occurs, verify the login all the way to the point that you have the customers_id, then...
1. Check the IP against your white list as I described in response to Linda's concern. You could even use the same exclusion list that Zen keeps for site maintenance.
2. Check the sessions table to see if that customers_id is already stored. If it's listed, don't continue; if not, allow the login.

This will undoubtedly sprout other unforeseen issues as you go along, that's why I kept the direction simple. Be wary of what Linda said and you should be fine.