- Does overtrue/laravel-single-session work with Laravel 8, 9, 10, 11, or 12?
- No, not reliably. The package targets the Laravel 5.5-5.6 era and has had no release since December 2017, so its Composer constraints on illuminate/support and illuminate/session will typically conflict with modern Laravel versions. Its session invalidation approach also predates later changes to session ID handling and AuthenticateSession semantics. On Laravel 8 through 12, use Laravel's native AuthenticateSession middleware and Auth::logoutOtherDevices() instead.
- How do I install overtrue/laravel-single-session?
- Install it with composer require overtrue/laravel-single-session. On Laravel 5.5 or 5.6, package discovery should register the service provider; on older versions you may need to add it to config/app.php manually, then register the middleware on the route groups you want to protect. On a current Laravel app the install will usually fail dependency resolution, and forcing it with --ignore-platform-reqs is not advisable for authentication code.
- How does overtrue/laravel-single-session invalidate older sessions on a new login?
- It adds a thin service provider and middleware that hook into Laravel's Auth and session lifecycle to track the active session for each user. When the user authenticates again, the previously recorded session is invalidated so only the newest one remains valid. The tracking state lives outside a dedicated table, so correctness depends on your cache or session store and its TTL and eviction behavior. The README does not spell out which session drivers are fully supported.
- Can I enforce one active session per user globally or only for selected users?
- The package advertises configurable enforcement, so you can apply single-session behavior per user or globally. In practice, enforcement is applied by registering the middleware on the route groups that should be protected, and any configuration is published through the package's config file. Because the repository is archived and documented only through its README, verify the exact option names against the source before relying on them.
- Does it need extra database tables or a specific session driver?
- The package advertises no extra database tables, so its bookkeeping uses the existing user record, session store, or cache rather than a dedicated table. That makes behavior dependent on the session driver: file sessions on multiple nodes cannot be reliably invalidated from another node, while Redis or database sessions are more deterministic. The description does not specify cache TTLs or eviction handling, so test your actual driver before trusting it.
- What is the modern replacement for overtrue/laravel-single-session?
- Use Laravel's native primitives: enable Illuminate\Session\Middleware\AuthenticateSession on authenticated route groups and add the password_hash column so password changes invalidate other sessions. Call Auth::logoutOtherDevices($password) when a user wants to sign out everywhere. If you need true one-session-per-user enforcement, a small login event listener that stores the current session ID per user in Redis or the database and invalidates prior IDs covers it in roughly 40 lines.
- Is overtrue/laravel-single-session maintained and safe for production?
- The repository is archived, has around 17 stars, no release since December 2017, and no CI or test evidence. That means no security patching, no CVE response, and effectively unaudited third-party code sitting directly in your authentication path. For anything security-sensitive, do not adopt it; the abandoned status and the weak project signals alone are enough to disqualify it.
- How do I log out other devices when a user changes their password in Laravel?
- Add the password_hash column to your users table and enable the AuthenticateSession middleware on the relevant route groups; Laravel then invalidates other sessions when the stored hash no longer matches. Alternatively, call Auth::logoutOtherDevices($password) after a successful password change. Both are built in and avoid an unmaintained dependency in the auth path.
- Does it work with multiple guards, Sanctum, or remember me tokens?
- The package claims compatibility with Laravel's built-in authentication guards, but it was written before Sanctum and modern token-based guards existed. Remember-me tokens and API guards use different session semantics, so single-session enforcement may not behave as expected without custom work. Validate any behavior against your guard matrix and session driver before rollout.
- How do I test single-session enforcement in Laravel?
- Use Laravel's testing helpers to log the same user in twice across separate sessions and assert that the earlier session is no longer authenticated. Feature tests with actingAs and multiple session instances, plus assertions on redirects or 401 responses from the middleware, cover the main path. If you replace the package, test the native AuthenticateSession path, remember-me tokens, and every configured guard.