title: Devise limit one session per user at a time
body: <p>My app is using Rails 3.0.4 and Devise 1.1.7.</p>
  
  <p>I'm looking for a way to prevent users from sharing accounts as the app is a subscription based service.  I've been searching for over a week, and I still don't know how to implement a solution.  I'm hoping someone has implemented a solution and can point me in the right direction.   </p>
  
  <p><strong>Solution</strong> (Thank you everyone for your answers and insight!)</p>
  
  <p>In application controller.rb</p>
  
  <pre><code>before_filter :check_concurrent_session
  
  def check_concurrent_session
    if is_already_logged_in?
      sign_out_and_redirect(current_user)
    end
  end
  
  def is_already_logged_in?
    current_user &amp;&amp; !(session[:token] == current_user.login_token)
  end
  </code></pre>
  
  <p>In session_controller that overrides Devise Sessions controller:</p>
  
  <pre><code>skip_before_filter :check_concurrent_session
  
  def create
    super
    set_login_token
  end
  
  private
  def set_login_token
    token = Devise.friendly_token
    session[:token] = token
    current_user.login_token = token
    current_user.save
  end
  </code></pre>
  
  <p>In migration AddLoginTokenToUsers</p>
  
  <pre><code>def self.up
    change_table "users" do |t|
      t.string "login_token"
    end
  end
  
  def self.down
    change_table "users" do |t|
      t.remove "login_token"
    end
  end
  </code></pre>