CODEWITHSUNDEEP
web-applicationsconcurrencysession
Dick Song
Dick Song

Reputation:

Should there be a limit to concurrent number of sessions for a web application?

Should there be a limit to concurrent number of sessions for a web application?

Upvotes: 2

Views: 2565

Answers (5)

dr. evil
dr. evil

Reputation: 27275

I assume you are talking about limiting same account for multiple sessions, otherwise ignore this :)

Depends, if it's high security application yes, this can avoid Session Hijacking issues (can be carried out many ways such XSS) as well as might help users to spot their account has been stolen and used by someone else.

In a normal web application which doesn't require high security, No. It's plain irritating.

Upvotes: 1

Kalium
Kalium

Reputation: 4682

Depends. Are you running in an environment where system resources are sufficiently scarce that you risk exhausting them by session use?

Upvotes: 0

krosenvold
krosenvold

Reputation: 77201

No.

Your application can be shut down for everyone for your entire session timeout (say 20 minutes), by a simple bot starting max sessions.

Upvotes: 0

Ryan Bolger
Ryan Bolger

Reputation: 1295

Do you mean on a per user basis or for the whole application?

Per user, the question depends on what the purpose of the web application is. If it's something like an online banking site, you could reasonable decide to only allow a single session per user for security. But if your app can already handle more than one session per user, it doesn't seem to make much sense to set an arbitrary limit.

On a per application basis, it doesn't really make much sense to set an arbitrary limit either unless you know it breaks down after a certain number of sessions for some reason.

Upvotes: 0

Alex Fort
Alex Fort

Reputation: 18819

No. Better to have your app be slow than to lock users out.

Upvotes: 0

Related Questions