- What does pbmedia/laravel-single-session do?
- It limits each user account to one active session at a time in a Laravel application. When the user signs in from a new browser or device, the package invalidates the older sessions so only the newest login remains active. It relies on Laravel's native authentication and session handling rather than adding database tables.
- Is pbmedia/laravel-single-session compatible with Laravel 11 or Laravel 12?
- No. The latest 2.0.0 release targets Laravel 5.6, so current Laravel versions are outside its supported range. A modern app should expect Composer constraint failures or runtime API drift. Use it only as a behavioral reference or in a legacy Laravel 5.6 codebase.
- How do I install pbmedia/laravel-single-session?
- Install it with Composer and register the package middleware according to its README. The package is designed for Laravel 5.6-era applications, so confirm the version pin and service provider setup before adding it to a project. It does not require schema changes, which keeps installation lightweight on supported stacks.
- Does this package require any database migrations or schema changes?
- No. It uses Laravel's native session handling and does not add tables or columns. The active-session tracking is layered onto the existing authentication and session flow. That said, the session driver and deployment topology still affect how reliably older sessions are invalidated.
- Which Laravel session drivers work with single-session enforcement?
- The package is built on Laravel's native session system, so it is intended to work with standard session drivers rather than a custom store. Behavior still needs verification for Redis, database, file, and multi-node deployments because invalidation must be visible across all app servers. Test your exact driver and topology before trusting it in production.
- Does it invalidate remember-me tokens, API tokens, or sessions across multiple guards?
- The package's scope is Laravel session invalidation for authenticated users, not a full token or device-management system. Remember-me cookies, API tokens, SSO sessions, and multiple guards may fall outside that scope and should be tested explicitly. If your requirement includes those channels, plan to extend or reimplement the logic.
- Can I use it for B2B seat licensing or to stop shared account use?
- Conceptually yes: one active session per user fits B2B seat licensing, shared-account controls, and privileged admin access. However, the published package is legacy and unmaintained, so it is better treated as a reference implementation than a production dependency. Decide the product behavior first, such as whether a new login wins or is rejected.
- What happens when two logins occur at the same time?
- The expected behavior is last login wins, with the older session invalidated when the new login is recorded. Concurrent logins can create race conditions, especially with distributed session stores or multiple app servers. Test this path and add locking or a session registry if you need deterministic behavior.
- Is pbmedia/laravel-single-session safe for production use?
- Direct production use is high risk for a modern Laravel application. The supported target is Laravel 5.6, which is long past end of life, and the package has no visible maintenance path or security patching. The 2.0.0 release is a compatibility-only major bump, which also signals limited semver predictability. Treat it as a non-production spike or legacy stopgap with an owner and exit date.
- Are there maintained alternatives, or should I build the single-session feature myself?
- The context does not identify a maintained drop-in alternative for current Laravel versions. For most teams, a small first-party implementation is safer: store the active session identifier for the user, invalidate the previous session on login, and enforce validity in middleware. The MIT license allows a fork, but that makes your team responsible for security, framework compatibility, and release discipline.