How to Implement Single Device Login in Web Applications

This article discusses how to implement single device login (限制一个账号只能在一处登录) in web applications. The author explains the difference between single device login and single sign-on (SSO), then presents two main technical approaches: token version control and WebSocket-based real-time forced logout.

The token version control approach uses a token_version field in the database. When a user logs in, the version is set to 1 and included in the JWT token. On subsequent logins, the version increments, and any token with an outdated version is rejected with a 401 response, forcing the old device to log out.

The WebSocket approach maintains active connections in Redis or a database. When a new login occurs, the server sends a WebSocket message to the old device to force logout, then updates the connection record. This provides immediate feedback but requires WebSocket protocol support.

The article compares both methods in a table, noting that token version control is simpler and more compatible, while WebSocket offers better user experience through instant notifications. A hybrid approach combining both is also suggested for optimal results.