ASP.NET prevent the same user being logged in multiple times

Question

I have a requirement for an ASP.NET web application whereby the same user is not allowed to be logged in multiple times. I think this is to prevent people from sharing usernames and passwords.

The problem I am having is that unless a user explicitly logs out of the system it is hard to tell if he is still logged in and using the system or not.

Hence the only reliable way I can think of to implement this is to log to database the user id, IP address and timestamp every time a user makes an interaction with the system and lock anyone else out who is not from that IP address if they try and log in within ten minutes of the last date logged in this table.

Can anyone think of a better way to manage this?

danyolgiax · Accepted Answer · 2011-06-14 08:16:43Z

6

If you use ASP.NET MembershipProvider you can do something like this:

    protected void Login1_LoggingIn(object sender, LoginCancelEventArgs e)
    {
        if (Membership.ValidateUser(Login1.UserName, Login1.Password))
        {
            int time = Membership.UserIsOnlineTimeWindow;

            MembershipUser user = Membership.GetUser(Login1.UserName, true);
            if (user != null)
            {
                if (user.IsOnline)
                {
                    lblMessaggeIsOnLine.Visible = true;
                    e.Cancel = true;
                }
                else
                    lblMessaggeIsOnLine.Visible = false;
            }
        }
    }

answered Jun 14, 2011 at 8:16

danyolgiax

13.2k10 gold badges71 silver badges118 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Okan · Accepted Answer · 2011-06-14 08:22:41Z

1

you can use SessionEnd event in global.asax if your session state mode is not SqlServer.

for example:

your config:

<sessionState timeout="15"></sessionState>

after 15min your sessionend event triggered and you can sign out user

answered Jun 14, 2011 at 8:22

Okan

111 bronze badge

Comments

Kangkan · Accepted Answer · 2011-06-14 08:23:34Z

1

You are right. You need to manage the user log-ins and act accordingly. Let me knonw whether you are using your own provider or using ASP.NET provider. The default provider has some options within it.

answered Jun 14, 2011 at 8:23

Kangkan

15.6k11 gold badges79 silver badges116 bronze badges

Collectives™ on Stack Overflow

ASP.NET prevent the same user being logged in multiple times

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related