When account A has logged into computer A, and then account A starts to log in to computer B, account A in computer A will automatically be logged out. May I know what are the possible reasons in why this feature should be implemented? How does it make it more secure?
From the perspective of a developer who recently has to implement such a feature, another possibility is to prevent the users shooting themselves in the feet.
Many custom/internal applications have very specific workflows and store a lot of state in the session. If the user abandoned some work halfway on one computer, finishes it somewhere else and return to the original computer, he/she may get confused about the unifinished work. If the user incorrectly chose to continue, then the original results may be overwritten / duplicated.
It is of course possible to improve the code to make this less likely, but for an internal app, the most cost effective way is to prevent concurrent logins.
I disagree with you : the session is not so difficult to be stored on a server-side nowdays, and if it's just difficult to make a memcached query, for example, it's pretty weird. Feb 18, 2016 at 18:57
@AlexeyVesnin It's not (just) about storing and retrieving session data, but the extra work of creating the UI/procedure to let the users discover and restore an abandoned process (and stop the work on the original host) and the training around it. Many organisations will not justify this cost and would go with one session/concurrent process only.– billc.cnFeb 18, 2016 at 19:13
2Agreed, an "economy-driven" code ensimplification is taking place, yes - but IMHO it's wrong and it's a very BAD practice Feb 18, 2016 at 19:15
The most common case is that the login is used as a workplace accounting token, i.e. "check how much time you're working on PC". The more logical reason, but it's not easy to see from a first sight, is that you simply physically can't be on the two geografically isolated places at the same time.
remote desktop?– Kris CFeb 18, 2016 at 17:48
I guess so.. but I think whether if the desktop is remote or not does not affect it also haha– user101736Feb 18, 2016 at 18:05
@XbatbatX sure it isn't : it will be unneccesserily laborious to check a desktop's geolocaton EVERY time when you need to auth someone to log into a PC =) So it's just set globally Feb 18, 2016 at 18:55