限制并发登录-ASP.NET身份

Question

I am trying to only allow a user account to be logged in, only once at the same time.

Eg User logs in via the browser on their computer, now they cant login at the same time on their phone as they are already logged in.

I can add a bool property to my user entity, that I can update when the user logs in and logs out.

However, I am using SlidingExpiration on the authentication cookie, therefore when the cookie expires it doesn't update my user property to say they are now logged out.

ExpireTimeSpan = <time period>,
SlidingExpiration = true,

Are there any better approach to restricting concurrent login?

Thanks

Answer 1

Can you generate a Token at log in and store it in Data base?
Then, check every time if the token matches with the one provided by user.
If he does log in in another device, the token will be overwritten and won't match with the first one, so the first session will become invalid.

EDIT:
As you asked in a comment, it doesn't block a user to perform a second log in in another device concurrently, it only invalidates the previous sessions.
Avoiding a second log in requires more job and isn't as safe as the method shown above.
Imagine that the user closes the browser without performing a log out... It will block the session.
An approximation of what you want will be adding the time parameter to your log in (adding it into the data base too, and updating the field on every user's action).
Then show the message of "you can't log in twice" if the token doesn't matches and the time span is not far enough (ie 5 minutes). But in my example you need to show a "your session expired" if the token has changed anyway.

Answer 2

"The idea is very simple every time the user logged in you have to generate random token , then you should save that token in the database and in session or if you are using Microsoft form authentication you can save it in the ticket, then each time the user request a page you'll check if the session token is same as database token , if not kick him out!"

http://engthunder.wordpress.com/2011/10/19/preventing-multiple-user-from-logging-in-using-the-same-username-single-user-login-at-a-time/