如何检测多个相似的登录会话的发生

Question

Currently, my .NET windows desktop app runs a background worker to check against the database (MSSQL 2008) whether a user has logged in to the app multiple times through other computers/devices.

How it's done is the background worker would run a check in the database and compare whether the last login IP address of the user is the same as the IP Address stored in the user session in the app.

If the IP addreses do not match (which means the user has logged in with another computer/device), the app would display a prompt asking the user to relogin. This also means only the app in the previously logged-in computer would show the message, not the currently logged-in computer.

If the IP addreses do match, the background worker (which is in a thread) will sleep for 5 minutes and repeat the checking process when it wakes up.

---

Problem

The checking occurs every interval of 5 minutes and I feel it is too long. However, if I make it shorter, it will consume more resources.

Idea(s)

The closest I can think of is using Trigger but AFAIK, Triggers only serve to trigger other sql statements, not to trigger a function block in the app.

Another idea I can think of is sending packets containing these user session info to all computers in the same network and implement an event handler to listen to the events that catch these packets... but I don't know if this is possible.

Answer 1

depending on the architecture of your application you can move the check on the database.

let's pretend you create the function MultipleLogin(@IPAddress,@UserName) that produces 1 when multiple session are found.

now add a call to that function in each and every stored procedure of your application and test for the output value: if multiple session are active raise an exception to be trapped & handled on the client.

the advantage:

1. you perform the check only when the user does anything, avoiding background tasks and processes not related to the application core functions
2. should you ever need to change the logic of the check, no need to update the clients

the disadvantage:

1. you perform the check only when the user does anything, so the duplicate session may go unnoticed for some time
2. the check is performed in many places and depending on the size of the project this may be an issue