We have some clients that use a web based application that does this by inserting a record into the database when a user logs in and removing the record when they log off.  These website you refer to may do something along these lines. This solution is a support nightmare because when users just close their browser instead of loggin off properly it leaves their record in the database so it looks like they are logged in.  We have tried numerous work-arounds (i.e. a stored procedure that we run periodically to try and clean-up these "orphaned" records) but it's still a poor solution.  Like Sebastian indicated, due to the nature of web-based applications there really is no good way to accomplish this (that I know of).

 "This solution is a support nightmare because when users just close their browser instead of loggin off properly it leaves their record in the database so it looks like they are logged in."

I've used something similar but just used an expiry time ... even if they don't log off the record in the database expires after say 30 mins, so you don't actually have to delete the record.

This was used in conjunction with a cookie...we would write a unique identifier to a cookie and then check this against the record in the database. If the identifier in the cookie doesn't match the identifier in the database, they are trying to log on again.

Hope it helps

Mike