A simple way is to close the session if there are too may open sessions at the same time
procedure TIWUserSession.IWUserSessionBaseCreate(Sender: TObject);
begin
if gSessions.GetCount >20
then
WebApplication.Terminate
end
procedure TIWUserSession.IWUserSessionBaseCreate(Sender: TObject);
begin
if gSessions.GetCount >20
then
WebApplication.Terminate
end