Laravel Single Session Laravel Package

Getting Started

Install with Composer and register the service provider if you are on a Laravel version predating package auto-discovery:

composer require pbmedia/laravel-single-session

The package is archived (last release June 2018), so pin it in composer.json and expect to stay on Laravel 5.5–5.8. First stop is the package's README.md and src/ directory — there is no maintained documentation. Look at the registered middleware and any event listeners in the service provider; that is where the "kill the previous session on login" behavior lives.

First practical use case: add the package's middleware to your web group (or just to authenticated routes) so that when a user logs in from a second device, the earlier session is invalidated. You will almost certainly need the database session driver — set SESSION_DRIVER=database, run php artisan session:table (or use the existing migration), and ensure your sessions table has a user_id column so the package can find and delete the previous session rows.

Minimal checklist:

1. composer require pbmedia/laravel-single-session
2. Register provider (older Laravel) or verify auto-discovery
3. Publish/consult any config file with php artisan vendor:publish
4. Switch to the database session driver
5. Attach the middleware to the web group
6. Log in from two browsers and confirm the first is logged out

Implementation Patterns

Middleware on the web group. The most common integration is appending the package middleware after StartSession and Authenticate in App\Http\Kernel::$middlewareGroups['web']. This gives you single-session enforcement globally with no controller changes.

Scoped to authenticated routes only. If you want anonymous visitors unaffected, apply it as route middleware on your auth route group instead of globally:

Route::middleware(['auth', 'single-session'])->group(function () {
    // dashboard, account, etc.
});

Login-event driven flow. The package hooks into Illuminate\Auth\Events\Login (or performs the same work inside middleware). If you need custom behavior — e.g. logging a security event when the old session is killed — listen to the same event in your own EventServiceProvider and record the previous session ID before the package purges it.

Pair with "remember me" deliberately. If you want remember-me tokens preserved while still enforcing one active session, keep Auth::viaRemember() handling intact and test the flow explicitly; the middleware should only invalidate the session, not necessarily the remember token.

Multi-tenant / multi-guard apps. Register the middleware once but make sure your session table's user_id is populated for every guard you care about. If you use separate guards with separate session keys, you will need to verify the package respects them, or wrap it with your own middleware that calls the package's logic per guard.

Testing. Write a feature test that logs a user in via two actingAs sessions (or two HTTP clients with separate session cookies) and assert the first is redirected to login. This is the fastest way to catch regressions if you patch the package.

Fallback pattern. Because the package is abandoned, wrap it: put a thin app-level listener or middleware around it so a future migration to Laravel's native AuthenticateSession + Auth::logoutOtherDevices() is a one-file swap.

Gotchas and Tips

• Archived and stale. No Laravel 6+ compatibility, no security patches. Treat it as legacy — do not start new projects on it. The modern equivalent is Laravel's built-in Illuminate\Session\Middleware\AuthenticateSession combined with Auth::logoutOtherDevices($password), which is maintained and framework-native.
• Session driver dependency. The package assumes it can enumerate the user's other sessions. With file or cookie drivers it will silently do nothing useful. Database (or a cache store you can query) is effectively required.
• Missing user_id on the sessions table. Older session:table migrations omit it. If the package "does nothing," check this column first.
• Race conditions. Two near-simultaneous logins (double-click, parallel API calls) can leave both sessions alive briefly or kill the wrong one. If strict enforcement matters, use a transactional delete or a per-user lock.
• Remember-me tokens survive. Users may be auto-logged back in via the remember cookie and perceive the "logout" as broken. Decide explicitly whether to clear remember tokens on invalidation.
• API/token auth unaffected. Sanctum/Passport tokens are not sessions; this package will not revoke them. Handle token revocation separately.
• Debugging. Instrument the package with a quick log line inside its listener (Log::info('single-session purge', ['user' => $id, 'sessions' => $ids])), then watch storage/logs/laravel.log and query the sessions table directly to verify rows are being deleted.
• Extension points are thin. There are no documented events or contracts to hook. If you need customization, fork the middleware (MIT license permits it) or, better, migrate to AuthenticateSession.
• Session fixation. Confirm the package calls Session::regenerate() on login rather than only deleting old rows — otherwise you are trading one security issue for another.