Prevent Multiple (Concurrent) Logins

[ICTECH]

I'm working on a Application and need to be able to stop users from login in multipe times... I've been trying out the samples I have found googling the topic.. But I can't seem to get any of them to work.. They all seem to be using a custom login page and I'm trying to use the Login control that MS build... Any ideas???

 

[jbenson001]

I don't know about the MS login control, you can problably customize it, but you will have to search for that answer. We use our own custom control that stores if the user is logged in in the DB. If they are, they cannot log in again.

 

[ICTECH]

how do you handle the session exit? If they don't click on logout???

 

[jmeckley]

session times out after 20 minutes by default. you can use the Session_End event to force the database entry for logoff. You can override the session time out as well, if needed.

class Global : HttpApplication
{
   protected void Session_Begin(object sender EventArgs e)
   {
       create db entry to log user into the system
   }

   protected void Session_End(object sender EventArgs e)
   {
       create db entry to log user out of system.
   }
}

then in the log in/out control you just need to verify the user. the global handlers will manage the database logging.

Jason Meckley
Programmer

faq855-7190
faq732-7259

 

[ICTECH]

Sorrt for the long delay in getting back to you all.. Do any of you have ang code examples?? Thanks...

 

[jmeckley]

there should be plenty of examples online of
1. configuring forms authentication
2. overriding/customizing/subclassing forms authentication

how you implement "is already logged on" doesn't matter. once the forms authentication component is subclassed you can put whatever logic you want in there. for example

class ExactlyOneInstanceSqlMembershipProvider
 : SqlMembershipProvider
{
   public override bool ValidateUser(string username, string password)
   {
       return base.ValidateUser(username, password)
           && NotCurrentlyLoggedIn(username);
   }

   private bool NotCurrentlyLoggedIn(string username)
   {
        //determine if the user is already logged in.
   }
}

then plug this into your forms authentication configuration. finally handle session logout.

public class Global : HttpApplication
{
   public void Session_End(object sender, EventArgs e)
   {
      //mark user as not currently logged in so they can log in again later on.
   }
}

Jason Meckley
Programmer

faq855-7190
faq732-7259

 

[ICTECH]

Thanks Jason for getting back to me so quickly...

How would you handle in code if a browser/windows crashed and the user didn't logout nicely??

I guess this would have to be part of the notcurrentlyloggedin routen.. What I mean is I'll have to check to see if the timestamp has expired (ie: has 15 minutes gone by since lastactiveDate). Or is there a better way to do this part?

Thanks again