0

My task is to prevent multi login with the same user.I did this using database column ActiveUserFlag(0 inactive user,1 for active user) but now issue is if user properly logged out i have set value 0 but if user not properly logged out for example Browser close machine shut down etc. value remain 0 in ActiveUserFlag column for that particular user. Now how to set flag value 0 in case not properly logged out.Please suggest ?

Thank you in Advance

Panagiotis Kanavos
  • 120,703
  • 13
  • 188
  • 236
Sunil Khankriyal
  • 114
  • 1
  • 1
  • 11
  • Monitor activity and log them out automatically after x minutes of inactivity? – spodger May 10 '18 at 13:29
  • 4
    This is a non-trivial problem, and almost always an unnecessary one. Why exactly should multiple simultaneous logins be prevented? If it's absolutely necessary then you may need to have a background process which continually monitors the user's last known activity and, if that activity is older than a session timeout, update the data. Though I imagine this will frustrate users who need to wait for that timeout before they can use your system again. – David May 10 '18 at 13:30
  • @David I use some tools at work that only allows one logged session per user, mostly because of licensing issues. – Anderson Pimentel May 10 '18 at 13:35
  • 3
    @AndersonPimentel that's a different problem. Preventing multiple logins isn't going to solve it. Instead of calling that tool immediatelly, queue the operations and execute them one at a time. Modify the application to tell the user they have to wait. – Panagiotis Kanavos May 10 '18 at 13:41
  • @AndersonPimentel: That doesn't really present a complete picure of the problem, and it still sounds like you're in a bit of an X-Y Problem here. What are these tools and how do they relate to your web application? Why *specifically* can't the same user be logged into *your* application in more than one browser or tab? What actual difference does that make? – David May 10 '18 at 13:43
  • 1
    @SunilKhankriyal why do you want this functionality in the first place? What are you trying to achieve? If this is a security requirement it's a *bad one*. People do connect from their mobile phones, are you going to prevent them? Or is this a licensing/multi-tenancy/API accounting issue? – Panagiotis Kanavos May 10 '18 at 13:46
  • @SunilKhankriyal besides ASP.NET *already* supports sessions. There are multiple questions that show how to handle the session lifetime events or how to properly extend the ASP.NET Identity mechanism to track last login time. – Panagiotis Kanavos May 10 '18 at 13:48
  • @PanagiotisKanavos Its our application requirement for security concern they want this functionality i achieve this using application variables but this logic will fail in case of web farm so i have to do this using database flag. – Sunil Khankriyal May 10 '18 at 13:50
  • Possible duplicate of [Prevent multiple logins](https://stackoverflow.com/questions/31831295/prevent-multiple-logins) – Panagiotis Kanavos May 10 '18 at 13:55
  • 1
    IMO doing this is anti-user and will just annoy people. If people have legitimate credentials to log into the application I fail to see how only allowing a single login session at once adds any actual security (since that's your stated goal). It's still the same individual having access to the data, just from a different device (or just a different browser, or different session within the same browser). What is the actual concern here? What kind of security breach do you think this will prevent? If you're worried about people leaving themselves logged in, make their session timeout short. – ADyson May 10 '18 at 14:02
  • 1
    @David Maybe I didn't make myself clear: they are support systems (BMC Remedy, for incident management, for one) that I use at work, but they do not relate with my applications. I was just giving an example of web applications where I see the same behaviour, and they use mainly because of licensing issues. They usually show a window telling me I'm already logged and asking if I want to abandon the other session. But I fully agree it sucks. – Anderson Pimentel May 10 '18 at 14:06
  • 2
    @AndersonPimentel: Ah, miscommunication on my part. I thought your initial comment was from the OP. Indeed, there exist applications which do this for one reason or another. They often have a variety of hacks to make it happen, but large enough budgets and accepting enough user bases that they can get away with it. – David May 10 '18 at 14:08
  • 1
    @SunilKhankriyal: *"our application requirement for security concern"* - Keep in mind that questioning the requirement is a valid response on your part. What "security" does this implement? What attack does it prevent? This sounds like a requirement that came from someone who doesn't fully understand what they're talking about, and it will add considerable work for no actual business benefit. – David May 10 '18 at 14:11
  • 2
    I agree with David: before continuing you should go back to whoever gave this requirement and ask them what _actual, real, specific problem_ (not vague waffle about "security") they think they are solving by implementing this. Almost certainly it will be a non-issue or a misconception. This feature does not do anything except make your users hate the application. A good developer should always challenge the requirements if they don't make any sense. We are not drones who just do whatever we are told, no matter how crazy it is. – ADyson May 10 '18 at 14:18

1 Answers1

2

You could create some background task that keeps updating a LastActivity date/time column.

At the logon, before checking ActiveUserFlag, write a routine to set ActiveUserFlag to 0 if the the user is away for too long, using LastActivity.

Anderson Pimentel
  • 5,086
  • 2
  • 32
  • 54