How to expire a login

[Alfred Tascon]

I want to eliminate multiple logins by expiring an existing login whenever a
user logs in.
This, I was thinking, will eliminate multiple logins as well as cater for
browser crashes.

So to put this into effect I have to find any current
sessions(authcookies?), if they exist, that user id might have open and
expire them during then login process.

Does anybody know how to do this? I am using
'FormsAuthentication.SetAuthCookie'.

Or maybe there is a better way?

Thanks in advance

Alfred

 

[Matt Berther]

Hello Alfred,

You could do FormsAuthentication.SignOut().

 

[Alfred Tascon]

Thanks, but the problem is that the new login is under a different session.
SignOut only removes the token from the current session.

Alfred

 

[Steven Cheng[MSFT]]

Hi Alfred,

Thanks for your posting. As for the question you mentioned, I think we
haven't any direct means to drop all the currently existing logined user's
Auth tokens (auth cookie) since the cookie are stored on the client side
and the serverside has no of them until a client request coming to the
server. And currently, one approach is that we maintain a lookup table at
serverside which contains the list of the logined users, and when each
request comming, before the page code execute, maybe you can try do this in
a application event such as (begin request or authenticate request) , we
check the lookup table, if dosn't in the table, use the
FormsAuthentication.Signout to logout the user.

Thanks

Regards,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

 

[Lowell Heddings]

One way that you could potentially do this is to store the SessionID in
a global(application) hashtable or object with the userid as a key, and
check that on each page to make sure that the current sessionid is the
right one, otherwise overwrite it on the new login.

That would log the original user out, effectively.. you could put code
to abandon their old session.

It's not a great solution, but it would work.

Lowell