Home/ Questions/Q 5929387
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-22T14:24:54+00:00

I am building an ASP.NET MVC3 app using Forms Authentication and I’d like to

  • 0

I am building an ASP.NET MVC3 app using Forms Authentication and I’d like to log out all existing sessions for a user when that user logs in. I’m trying to prevent multiple people at different workstations from logging in and working under the same account.

Is there a standard way of handling this? Logging out the existing session is easy, but I haven’t come across a way to check for other sessions by the same account and log them out.

I have a few ideas on how to hack this, but I’m curious if there’s an established method for this using IIS or the FormsAuthentication API.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Because of the statelessness of the web, you can’t “log out” a session until they make their next request (for instance, session might be maintained in a cookie, which can’t be written on the client outside of the context of a request-response interaction).

    There is still a solution, which assumes you are using session state, and preferably you have a common base controller for all of your controllers requiring “Authentication”.

    Upon successful login, generate a token (a guid perhaps) and store that with the session. Also write this to a application-wide store (database or application context for instance) keyed by the userid.

    In the Base Controller (or otherwise you’d have to create an action filter) check the token in session against the token registered for the userid in the application-wide store. If they don’t match, log out the user using the standard SignOut() call.

    • 0