Hi

Assuming you are using mix phx.gen.auth, a users_tokens table (Schema) is created. You can change it so that, when a user tries to login, to check this table is there is already a token for him. If yes, you can destroy it.

If you are not using phx.gen.auth, you can just follow the same strategy. Create a table to keep your users sessions, every time a user tries to login, check from this table if an existing session exist for this user.

Not sure what you mean. Which part of it would you like me to write?

For me, its not about the code. Its about the logic. And the logic is there. Persist the user session, when a user tries to login from different device ou web client, delete the previous persisted session.

And what do you do when they forget their password? You need email anyway to send them their new password or link to reset password. Or you can use an SMS or an external app, but given your problem with sharing emails, I doubt that mobile phone are not shared by many people as well ;D.

But if it’s like an intranet type of thing. For example, students that login with their IDs or some student card ID and some password you/department of the school or library or oganisation give them, why not. But then it would be best to implement it from scratch and forget the whole sending email and reseting thing altogether and the admin of that intranet website would be doing that manually or something when they reach for him or something.