Using sessionid to check whether a user is validated?

This is sort of a weird situation, but if I grab a user's sessionid from the modx_user_attributes table, is there a way to use that sessionid to see if that user is logged in or not? This is *not* for the current user: we need to check on other users. We're doing an oAuth login flow so when a user comes to our MODX site, they also get logged in on another site and we pass that site a few bits of data about the user (e.g. username, email, etc.). The other site then makes some API requests back to our site to retrieve additional data (specifically data that might change as the user does stuff on the site).

I'm wondering if I pass the sessionid to the other site along with the other userdata upon login if the other site can hash that sessionid and we can use that to authenticate the request somehow. E.g. other site sends us md5($sessionid) and we can do md5($user->get('sessionid')) and if they match we know the other site is making a legitimate request for this session.

Or in more broad terms, can I look at the sessions in the database and know whether a user's session is active or not?

Quote from: Everettg_99 at Sep 21, 2013, 12:54 AM

Or in more broad terms, can I look at the sessions in the database and know whether a user's session is active or not?

Not reliably, or in my opinion and more importantly, securely. The session_id changes anytime any change in privileges occurs to prevent session hijacking. I would look into implementing a way to track such things separately. This approach would also work regardless of the session implementation being used, i.e. what if you want to switch away from the default database session handler? This is why the modActiveUser class exists. The OnManagerLogin/OnWebLogin and OnHandleRequest events would be the place to set the data to look for if you want to track this separately. I would be inclined to use a modDbRegister topic to record messages that record the time of the last hit by userid (encoded would be good), perhaps with an expiration set.