# Restful\_authentication plugin + session timeout + single login session?

**URL:** <https://www.ruby-forum.com/t/restful-authentication-plugin-session-timeout-single-login-session/124577>\
**Category:** Rails\
**Created:** [December 30, 2007, 2:49pm UTC](https://www.ruby-forum.com/t/restful-authentication-plugin-session-timeout-single-login-session/124577 "2007-12-30T14:49:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kei\_Simone](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/839c29/32.png) [@Kei\_Simone](https://www.ruby-forum.com/u/Kei_Simone)\
**Post date:** [December 30, 2007, 2:49pm UTC](https://www.ruby-forum.com/t/restful-authentication-plugin-session-timeout-single-login-session/124577/1 "2007-12-30T14:49:09Z")

</div>

Hi,

I am using restful authentication plugin

1. I was wondering if there is a way to do a session timeout using the  
restful\_authentication.

How do I hack it to get the behaviour I need?

1. On top of that, I may need to ensure that a particular user can  
only login from a single PC. If the user is already logged in at a PC  
and attempts to login from another PC, the session in which he signs  
in on the first PC will auto log out.

Again, I would like to know how that is possible given  
restful\_authentication.

Thank you all.

---

<div class="post-metadata">

**Author:** ![Kei\_Simone](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/839c29/32.png) [@Kei\_Simone](https://www.ruby-forum.com/u/Kei_Simone)\
**Post date:** [December 30, 2007, 4:31pm UTC](https://www.ruby-forum.com/t/restful-authentication-plugin-session-timeout-single-login-session/124577/2 "2007-12-30T16:31:39Z")

</div>

The only way i know about to expire a rails session is to remove the  
session key from the db (if you’re using activerecordstore) or session  
files from tmp/sessions (if using file system)  
You can do this with a simple rake task that you run periodically with  
cron, which checks for any records/files updated\_at \> time.now - 20  
mins and destroys them .

Something like [Parked at Loopia](http://pastie.caboo.se/133243)

The second question requires something a bit more. You would most  
likely create an extra column in the db which you could use to store  
the key that matches the session, then when you log in you destroy the  
previous session record.

In order to easily manipulate the session table you can create a model  
called session.rb which inherits from ActiveRecord, or you can access  
it directly using … CGI::Session::ActiveRecordStore::Session

Haven’t done this myself but there seems to be bags of information  
about retrieving and manipulating session ids and data here  
[http://www.quarkruby.com/2007/10/21/sessions-and-cookies-in-ruby-on-rails#sactive](http://www.quarkruby.com/2007/10/21/sessions-and-cookies-in-ruby-on-rails#sactive)

More information and a plugin for dynamic session expiration can be  
found here:  
[http://blog.codahale.com/2006/04/08/dynamic-session-expiration-times-with-rails/](http://blog.codahale.com/2006/04/08/dynamic-session-expiration-times-with-rails/)  
and general information on sessions here:  
[http://wiki.rubyonrails.org/rails/pages/HowtoChangeSessionOptions](http://wiki.rubyonrails.org/rails/pages/HowtoChangeSessionOptions)