🔐 Enforce Single Active User Sessions in OutSystems with Concurrent Session Control

✅ Available on OutSystems Forge 🔗 Concurrent Session Control (O11)

🚀 Introduction

Many business-critical applications require users to have only one active session at a time. Whether for security, licensing, or data integrity, enforcing this rule can protect your system from misuse or unauthorized concurrent access.

That’s why I’ve developed the Concurrent Session Control component — now available on OutSystems Forge. This plug-and-play solution helps developers enforce single-session behavior in any OutSystems Reactive Web App with minimal configuration.

🧐 Why Concurrent Session Control?

By default, OutSystems allows users to log in from multiple devices or browsers at the same time. But this behavior is not always desirable in environments such as:

• Banking and financial systems
• E-learning platforms
• Enterprise admin dashboards
• Government and compliance-driven apps

These systems often require tighter control to prevent:

• Account sharing
• Session hijacking
• Inconsistent data updates
• Breach of license limits

🧩 What the Component Does

The Concurrent Session Control component handles:

1. Token Generation: Upon login, a unique session token is created.
2. Session Storage: The token is stored in an entity (ExclusiveUserSession) with timestamp and user ID.
3. Session Invalidation: If a token already exists for that user, it is replaced.
4. Client-Side Validation: A timer on the client continuously checks if the stored token is still valid.
5. User Sign-Out: If the token is no longer valid (i.e., user logged in elsewhere), the current session is terminated with a notification.

⚙️ Key Features: Concurrent Session Control

🗂️ Entity: ExclusiveUserSession

📌 Purpose: Stores session-related data 🧑‍💻 Fields: 👤 User ID 🔐 Token 🕒 Token Generation Time & Expiration Time

🧩 Actions

🔄 GenerateUserTokenWithSingleSession

🎯 Generates a unique session token for the user 🚫 Ensures only one active session per user at a time

✅ ValidateUserToken

🔍 Checks whether the stored token is still valid 📉 Prevents usage if the token has expired or is invalidated due to a new login

⚙️ Site Properties

🕓 UserTokenValidityDurationMinutes 🛠️ Default Value: 180 minutes ⏱️ Controls how long the generated token remains valid 🧠 Can be customized based on security requirements

🧾 CheckTokenExpiration 🔍 A flag to control whether the system should validate token expiration 📅 Used to compare the token’s expiration DateTime against current server time ✅ Type: Boolean

🧪 Demo Flow Included

A ready-to-use implementation that demonstrates:

💾 Storing the token in a Client Variable Variable Name: UserToken

🚀 Using On Application Ready to: 🔁 Validate the token every few seconds ⛔ Redirect users to the logout screen if their session becomes invalid

🛠️ How to Use It

[1] 🧠 Add Client Variable to Store the Current Token

📦 Client Variable Name: UserToken 🧾 Type: Text

[2] 🔐 Modify Your Login Logic to Call GenerateUserTokenWithSingleSession

🧩 After a successful login, call the **GenerateUserTokenWithSingleSession** action to issue a unique session token for the user.

[3] 💾 Store the Generated Token in a Client Variable

🧩 After calling GenerateUserTokenWithSingleSession, store the returned token in a client variable named UserToken.

[4] 🚀 Create OnApplicationReady Event

[5] 🧪 Token Validation Strategy

✅ Use ValidateUserToken on application load 🔁 Also call it periodically using setInterval() in JavaScript

🧠 Important Check: Before executing the validation, ensure the user is not anonymous and the UserToken exists to avoid unnecessary processing.

[6]🚪 Log Out User if Token is Invalid

🧪 This logic should run inside the OnApplicationReady loop (or setInterval) after calling ValidateUserToken.

✅ Steps:

1. 🔍 Call ValidateUserToken
2. 🔄 Check the result

• If the token is valid, do nothing
• If the token is invalid, proceed with the following steps

1. ⚠️ Show notification message to the user (e.g., “Your session has expired. Please log in again.”)
2. 🚪 Log the user out
3. 🔁 Redirect to the login screen

All steps are documented clearly in the Forge component.

💼 Use Cases

• Financial Apps: Prevent multiple simultaneous logins for the same user.
• Admin Portals: Limit per-user access for license control.
• Online Exams: Ensure a test-taker can’t access from multiple devices.

📥 Download & Documentation

You can install the component and view full setup instructions here: 🔗 Concurrent Session Control on Forge

🧠 Final Thoughts

Managing user sessions is essential to application security and user experience. With this component, you can enforce single-session policies easily in OutSystems without reinventing the wheel.

If you’re building secure apps with OutSystems, this tool can help you simplify session logic and strengthen your authentication strategy.