# Deny login when active session exists

**URL:** <https://community.auth0.com/t/deny-login-when-active-session-exists/131102>\
**Category:** Get Help\
**Tags:** actions-management-api, management-api\
**Created:** [April 3, 2024, 1:49pm UTC](https://community.auth0.com/t/deny-login-when-active-session-exists/131102 "2024-04-03T13:49:36Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![moj](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@moj](https://community.auth0.com/u/moj)\
**Post date:** [April 3, 2024, 1:49pm UTC](https://community.auth0.com/t/deny-login-when-active-session-exists/131102/1 "2024-04-03T13:49:36Z")

</div>

I am trying to make a post-login action that check if any sessions related to the user exists. If any sessions exist the new users should be denied.

I tried this:  
exports.onExecutePostLogin = async (event, api) =\> {

const ManagementClient = require(‘auth0’).ManagementClient;

const management = new ManagementClient({  
domain: event.secrets.domain,  
clientId: event.secrets.clientId,  
clientSecret: event.secrets.clientSecret,  
});

const sessions = await management.getUserSessions({ user\_id: event.user.user\_id });

// If there are existing sessions, reject the login attempt  
if (sessions.length \> 0) {  
api.access.deny(`User aready logged in on (${sessions.length}) other device`);  
}

};

but it says that the functions does not exist. The goal is to never have more than one session at a time by the same user. I want to do this, to restrict the user to use one device at a time.

Can anyone help with this?

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [April 3, 2024, 4:46pm UTC](https://community.auth0.com/t/deny-login-when-active-session-exists/131102/3 "2024-04-03T16:46:56Z")

</div>

Hi @moj,

Welcome to the Auth0 Community!

Firstly, with the ManagementClient, there are no methods that can get the user’s session, nor is there a method called `getUserSessions` (Reference: [management | auth0](https://auth0.github.io/node-auth0/modules/management.html)).

Instead, you can call the [`event.session`](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/event-object#:~:text=example.com.-,event.session,-(Optional)) property in your action script to get details about the user’s current session. From there, you can inquire whether the user was previously logged in somewhere else. Using the `user_metadata` to store this information could also be helpful.

Let me know if you have any questions.

Thanks,  
Rueben

---

<div class="post-metadata">

**Author:** ![moj](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@moj](https://community.auth0.com/u/moj)\
**Post date:** [April 4, 2024, 6:32am UTC](https://community.auth0.com/t/deny-login-when-active-session-exists/131102/4 "2024-04-04T06:32:20Z")

</div>

Thank you for the answer.

I’m not sure how I would inquire whether the user was previously logged in somewhere else. Would you store the session id’s in the user meta data?

Could you elaborate on how i would implement this?

---

<div class="post-metadata">

**Author:** ![rueben.tiow](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/rueben.tiow/32/11646_2.png) [@rueben.tiow](https://community.auth0.com/u/rueben.tiow)\
**Post date:** [April 15, 2024, 10:24pm UTC](https://community.auth0.com/t/deny-login-when-active-session-exists/131102/5 "2024-04-15T22:24:24Z")

</div>

Hi @moj,

Thanks for your reply.

I have done some testing and found that the `event.session` object does not return enough information about the user’s session to inquire whether it’s an active session.

Not only do we need the `session_id` to determine whether the session is the one that exists, but we also need to ensure that the session is active by checking the `expires_at` property.

To do this, you will need to use the Management API in your Action script to [get the user’s session.](https://auth0.com/docs/api/management/v2/sessions/get-session)

I hope this helps!

Cheers,  
Rueben

---

<div class="post-metadata">

**Author:** ![thushalya](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/thushalya/32/62532_2.png) [@thushalya](https://community.auth0.com/u/thushalya)\
**Post date:** [November 24, 2024, 4:44am UTC](https://community.auth0.com/t/deny-login-when-active-session-exists/131102/6 "2024-11-24T04:44:36Z")

</div>

Have you figured this? @moj

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [December 8, 2024, 4:45am UTC](https://community.auth0.com/t/deny-login-when-active-session-exists/131102/7 "2024-12-08T04:45:32Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.