mvc C# session 多次登录后丢失

Question

I'm creating a simple website for multiple users. Now i'm trying to make the profile of each one so when they login they can see their data. The problem is that once logged in with one user and i login with another one my session gets "overwritten" and the new user become the old one. So i think i'm messing up with the session part.

I'm telling you what i've done.

1. Inside the login controller i call a the Login function, passing username and password.

2. Then i validate the user credentials to the database and if the user has been authenticated i do:

   new_session = new UserSession();

   new_session.SessionSet(obj);

Inside the "SessionSet" i just initialize some variables i need:

this.id_account          = obj.id_account;
this.id_user             = obj.id_user;
this.username            = obj.username;

3. At this point i return the new_session to the Controller and if it is not null i just add it to the session:

   Session.Add("user", new_session);

The problem now is how can i get this specific object form: views, classes and controllers? If i write in a view:

(((UserSession)Session["user"]).username)

I get only the "user" object so when 2 users log in at the same time, the session refer always to the "user" one.

I googled it but i can't find an answer that fits to my needs.

Answer 1

1. get database UserSession data
2. see user with this useID Is logged in
3. if user logged in {not allaw login} else {allow login}

or write data in session with timeout

if(Session["users"] != null)
{
    List<UserSession> users = (List<UserSession>)Session["users"];
    var finduser = users.Where(a=> a.id_user == newUser.id_user).FirstOrDefault();
    if(findUser == null)
    {
        //add user into session
    }
}
else
{
    Session.Add("users",newUser);
}

and web.config file set timeout logout and session equal

<sessionState mode="InProc" timeout="20"></sessionState>
<authentication mode="Forms">
  <forms loginUrl="/Pages/Default" timeout="20" slidingExpiration="true" />
</authentication>