Question

I have a requirement for an ASP.NET web application whereby the same user is not allowed to be logged in multiple times. I think this is to prevent people from sharing usernames and passwords.

The problem I am having is that unless a user explicitly logs out of the system it is hard to tell if he is still logged in and using the system or not.

Hence the only reliable way I can think of to implement this is to log to database the user id, IP address and timestamp every time a user makes an interaction with the system and lock anyone else out who is not from that IP address if they try and log in within ten minutes of the last date logged in this table.

Can anyone think of a better way to manage this?

Answer 1

If you use ASP.NET MembershipProvider you can do something like this:

    protected void Login1_LoggingIn(object sender, LoginCancelEventArgs e)
    {
        if (Membership.ValidateUser(Login1.UserName, Login1.Password))
        {
            int time = Membership.UserIsOnlineTimeWindow;

            MembershipUser user = Membership.GetUser(Login1.UserName, true);
            if (user != null)
            {
                if (user.IsOnline)
                {
                    lblMessaggeIsOnLine.Visible = true;
                    e.Cancel = true;
                }
                else
                    lblMessaggeIsOnLine.Visible = false;
            }
        }
    }