Member Avatar for shankbond

Hi,

I am having a web application, which can be accessed by different users based on their userid's and passwords.

Now I want to prevent users from accessing the application from more than one system.

In order to prevent this I have created a table with three columns as :

userid password flag


with flag having two values (true, false)

true means that user is logged in

false means looged off

session id generated by the server when the session is created

SESSION.SESSIONID gets the id generated on the IIS.

reference: http://msdn.microsoft.com/en-us/library/ms524326.aspx

now how can I delete it?

so that there can be only one user per user id.
In short I want to implement a feature used by gmail where one user can expire or log out all other users on different machines using same user id's.
am I right in achieving the goal?

I don't want to use Asp.net MembershipProvider.


thanks

Shankbond

  • 2 Contributors
  • 2 Replies
  • 188 Views
  • 9 Hours Discussion Span
  • Latest Post Latest Post by shankbond

Dani AI

Generated

Short version: don’t try to “delete” another browser’s ASP.NET SessionID cookie — you can’t force a remote browser to remove its cookie. Instead follow ’s idea and implement a server-controlled login token per browser. In practice that means: issue a cryptographically-random token at login, store it server-side (with user id, created/lastSeen, optional IP/userAgent), set it as an HttpOnly Secure cookie, and validate that token on every request. To log out other machines, remove their tokens from the database; their next request will fail validation and you can redirect them to the login page.

Example flow and minimal schema:

  • Table: LoginSessions(UserId, Token, IssuedUtc, LastSeenUtc, ClientInfo)
  • On successful login: create token, insert row, set cookie.
  • On each request (Global.asax/HttpModule/middleware): read cookie, check DB; if missing/expired -> clear cookie and redirect to login.
  • To “logout other sessions”: delete rows for that user except the current token.

Code snippets (conceptual):

var token = Guid.NewGuid().ToString("N");
// insert token into LoginSessions for userId
var cookie = new HttpCookie("AppAuth", token) { HttpOnly = true, Secure = true };
Response.Cookies.Add(cookie);

Validation and expiring others:

protected void Application_BeginRequest(...) {
  var c = Request.Cookies["AppAuth"];
  if (c==null || !IsTokenValid(c.Value)) {
    Response.Cookies.Add(new HttpCookie("AppAuth","") { Expires = DateTime.UtcNow.AddDays(-1) });
    Response.Redirect("~/login.aspx");
  }
}

// logout others (server-side)
DELETE FROM LoginSessions WHERE UserId=@userId AND Token<>@currentToken

Notes and cautions: use TLS, HttpOnly, and long random tokens (consider RNGCryptoServiceProvider or equivalent). Choose either “single-token per user” (store one token on Users table) to force single session immediately, or the multi-row approach to allow multiple machines and selectively revoke. Session.Abandon only affects the current server-side session object; it won’t reliably terminate other browsers. For immediate UI notification of revoked sessions use server push (SignalR/WebSocket) or client polling.

Recommended Answers

All 2 Replies

Member Avatar for DangerDev

In short I want to implement a feature used by gmail where one user can expire or log out all other users on different machines using same user id's.

you can do this by having a table(say login_detail) in server with column:
UserId, ClientSessionValue

When ever user login, store unique cookie(ClientSessionValue) in browser as well as in login_detail table. so if user is going to login from 3 machine, store his id 3 times against the 3 different ClientSessionValue in data base table.

So when ever user want to logout from a machine, delete one row from login_detail of corresponding ClientSessionValue.

When ever any request will come from client it will come with ClientSessionValue cookie. so if this value is not present against that user means, that user is logged out of that machine.

Now, if user want to expire or log out all other login from different machines, just delete all rows except one row from where delete request has come.

Member Avatar for shankbond

When ever any request will come from client it will come with ClientSessionValue cookie. so if this value is not present against that user means, that user is logged out of that machine.

.

How am I going to delete that client session value?
that is what I am trying to know ?
any help shall be appreciated
thanks

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.