Preventing concurrent logins - Classic ASP

[BenM]

Description:
I would like to prevent a user from logging in with their user/password
combination on a different computer or even a different browser window, if
they are already logged in. I have a login page, from which I use a DB check
to verify user/password info. Also, I have a bit loggedIN field in the DB,
which I use to see if they are currently logged in; if so, I prevent them
from logging in a second time.

Problem:
Unless they click the "Log Out" button, then the DB value does not get
changed. Any suggestions as to how I can log them out, even if they simply
close the browser window or jump to a different page?

Thanks in advance!

 

[Mark Schupp]

1. Put a timestamp in the database and update it with every page hit. Then
you can have the login "time out"

2. At login time, give the user the option to cancel the pre-existing
session if one exists. You'll need to keep a unique "logged on" identifier
instead of a simple flag to block the previous session if an attempt is made
to re-use it.

 

[larrybud2002]

Description:
I would like to prevent a user from logging in with their user/password
combination on a different computer or even a different browser window, if
they are already logged in. I have a login page, from which I use a DB check
to verify user/password info. Also, I have a bit loggedIN field in the DB,
which I use to see if they are currently logged in; if so, I prevent them
from logging in a second time.

Problem:
Unless they click the "Log Out" button, then the DB value does not get
changed. Any suggestions as to how I can log them out, even if they simply
close the browser window or jump to a different page?

Here's what I do: I have a table that contains the user ID,
application ID (which is just an identifier to the different apps we
have) an session ID.

Then the user logs in, those fields are populated. Every time a page
loads we have a toolbar that is included on each page. That page then
checks the current session ID against the database. IF it doesn't
match, I send them to a page which says "You can only be logged into
the application in one browser at a time"... or something like that.

So what ends up happening is that whatever browser session logs in
last, that's the valid session. That way someone could leave their
desk, go to another workstation, and still be able to log into their
account.