防止并发用户会话ASP.NET Core

Question

I am trying to prevent multiple concurrent sessions for a user using ASP.NET Core and CookieAuthentication middleware.

Any tips on how to do this?

Ideally, once a user signs in, the app would invalidate and effectively "sign out" all other existing cookies issued for that user. Then, the old sessions would be redirected to the sign in page on the next interaction with the server. So far, I have not found a way to do this.

I have been trying to figure out a way to use a custom validator as described in the documentation .

Thanks!

Answer 1

This is how I've handled it (using ASP.NET Core, but that is irrelevant): To do this you need to maintain state somewhere that is accessible to your server(s). You can store a session ID in a database when the user logs in. Each web app client should hit a heartbeat url (eg, every few minutes). The back end for the heartbeat checks the session id in the database. If it is the active one for the user, then all is good; otherwise it clears the cookie. If you are using a persistent connection to the client (websocket) then you can push a message to the client to indicate the session is no longer valid.

If you need to be sure that no other action by the user's other session can take place once a new session has started, then you'll need to check the session (as described above) on every call. ASP.NET Core's middleware capability is perfect for this.