[#7400] CB Antispam problem

Hello,
I am trying to configure the CB antispam duplicate logins to work but it doesn't logout the previous user.
The settings are:
block: enable
active logins: 1
block method: logout current session

Joomla Version: 3.9.1
PHP: 7.2.9
MySql: 5.7.20

I have two browsers (Firefox / Chrome) that I am logging in at the same time and the system doesn't stop that.
Could you check if it's a bug or if there is something that I have to check?

Regards,
Manolis

Are you testing with a regular registered user? CB Moderators are exempt from the blocking functionality so it will have no impact on your admin account.

Hello,
Yes it is a registered user without admin rights.

Navigate to the _sessions database table and confirm the user has more than 1 database session as that's all it's checking. It counts the number of database sessions for a given user id and if there are more than specified in "Active Logins" it should handle them as specified in "Block Method". The logout current sessions just deletes their sessions. Both the count and delete act directly on _sessions so it can't really fail.

My best guess is globally blocks maybe disabled within CB AntiSpam > Parameters > General, the user you're testing either has CB Moderator permissions as per Moderator View Access Level within CB > Configuration > Moderation, or you've whitelisted them in CB AntiSpam > Whitelists.

Hello again,
The parameters are right, user doesn't have any moderator rights and is not whitelisted.

These are the results for the sessions table:
1. First user with Firefox logs in the site
-> sessions table has one record for the user and the session id (id1)
2. Second user logs in with same user/pass with Chrome
-> sessions table has one record for the user and different session id (id2)
3. Refreshing the Firefox tab (user 1 that now had to be logged out)
-> sessions table has 2 records for the user and with session ids (id1, id2)

So I could confirm that it deletes the session but on refresh of the browser is back.
Could you think what may be wrong?

Joomla seams to be recreating the session on refresh from cookie. Nothing we can really do about that as it only checks for duplicate logins at time of login. It'd be too heavy to check over and over on every page so it doesn't account for the test case you're doing, which is unlikely to happen in normal usage. Have added a bug ticket to investigate further as there maybe a way to invalidate at least 1 of the users cookies to try and prevent this.

forge.joomlapolis.com/issues/7400