Thought I'd repost this as I replied to an old thread too...

Considering the UsersOnline module.

Looking at the table in the db, it keeps a record of all users online by UserID.
I have not looked at the code as yet so...

Questions:
How does that module track the users logging off? What about simply closing the browser without logging off?

Suggestion(s):
Now, what if an amendment is made to the DNN login (core team?) to check if the UsersOnline module is installed and in use?
What about providing a flag to set in login requirements for the Admin or Host to choose to check UsersOnline? Like requiring CAPTCHA or not...

Therefore, for those who want it, if configured, when a user logs in, if in UsersOnline table, block that login, display msg...

I'm guessing that the UsersOnline table is periodically cleared of "orphaned" records if users have just closed the browser without logoff.

Sebastian,

I understand the implications. Running a subscription-based service really needs this kind of protection not to mention users' exposing their data to others IF their credentials have been compromised.

If preventing 100 people from using the same login with the user(s) having to wait 20-30 mins to login, sobeit.
Every 1 user sharing their login with others, subscription sites loose $$. 100 x $fee for every login compromised/shared can be a lot of lost revenue!

It would be nice IF, as I suggested, the UsersOnline module is in use, the Admin/Host can choose to "check for duplicate logins"  under "User Account Settings".

That way we have a choice, it would be IN the core, no special login module needed and we can keep using using registration/subscription module(s) that make use of the core framework/data.

The ensuing support nightmare (if/when that happens) is up to us to deal with!

BUT, it would be great to see this as a core piece of funstionality!

Well, consider this:

Many companies/people have intentions, wanted to, or do implement subscription services.
Access to priviledged info, functionality and services = $$.

Specific user-groups and people therein are connected. They share info/data etc.
If 1 person buys access, what is to stop that person sharing amongs the group/community? Revenue LOST!

From a business perspective, DNN should REALLY consider putting this limited-login IN as an OPTION, then let the companies using DNN, decide whether or not to deal with the support issues surrounding this. I know it adds to support issues, but the now-protected revenue (for want of a better expression) would negate that!

Having the UsersOnline module already there is a start! I don't think it that much of a leap to extend to incorporate limited-login.

Having the choice is better than not having that at all.