Question

im banning users using the following:

MembershipUser user = Membership.GetUser(username);
if (user != null)
{
    user.IsApproved = false;
    user.LastLoginDate = DateTime.Now;
    Membership.UpdateUser(user);
}

if the user is currently logged in they can still do things on the site, so how can i also log them off?

Answer 1

On your global.asax you can do something like this..

Application_OnAuthenticateReuqest(object sender, EventArgs e)
{
  if(!UserHasAccess())
  {
     FormsAuthentication.SignOut();
  }
}

private bool UserHasAccess()
{
   var user = Membership.GetUser(Context.User.Identity);

   return user.isApproved;
}

You may want to consider some form of caching…

And btw I am assuming you’re using proper [Authorize] attributes on your controller methods.