abandon specific session

[mharness]

Hello,

I'm working on an approach to systematically and automatically log users on
and off an app that precludes users from sharing usernames and passwords.

I have most of that working except for how to deal with a user that simply
or mistakenly closes the browser window (does not explicitly log off). As
it stands right now, they will have to wait at most 20 minutes for their
original session to time out (which completes the proper log out in the
session_end event in the global.asax) before they can log back on and
although I don't really have a problem with that wait (which I could shorten
I suppose), I'm sure it's going to po a few users.

When that user tries to log back on I'd like to check to see if their
previous session has timed out and if not, abandon it so they can log on
without waiting for the timeout. I've saved the sessionid so I guess what
I'd need is something like a session.abandon that allows me to specify the
sessionid.

Any thoughts, alternatives?

Thanks,

Mike

 

[Aidy]

Any thoughts, alternatives?

Don't try and retict multiple logons. The reason you never see sites do it
is due to the issues you are encountering.

ISTR seeing a technique where, on the starting of the session, you see if a
SESSIONID cookie exists and if it does you assume they shut their browser.
It's a vague memory, google will probably find the code.

 

[Patrice]

If the previous session timed out you don't have to abandon this session.
You could also keep track yourself of the last use of a particular session
if this is what you meant and then remove it from your onw list if you
consider it has timedout.

You don't have control accross sessions (unless using a SQL Server provider
for example that likely does something similar to what is described above).

You could also track the IP/Port and consider this is the same user. It
would perhaps avoid to have to wait too long to reconnect...