限制对Asp.Net应用程序的并发访问

Question

I want to limit concurrent access to internet or intranet web applications.

I want to be able to allow certain number of concurrent access, let's say I want to allow maximum 20 concurrent access using the same username.

I can imagine creating a session at the login time and save it into DB with incrementing a counter, but there is no way to delete it from the DB and decrement the counter if user is logged off, as user may just close the browser.

Guys, what is the best way from your opinion?

Thanks,

Answer 1

You are right in that you cannot know if a user just kills his browser or pulls the cord.

Create a timer that does an Ajax call every 30 seconds and log it. If a user isn't in this log for 60 seconds - throw'em out at the server.
This won't stop someone from leaving their browser open over the night and hogging a slot though.

There is another answer mentioning an "last active" field. This on the other hand messes up when someone needs to leave their browser open to look at something for more than the timeout limit of minutes.

If someone is thrown out due to the user/timeout limit; I think it would be nice to have them automagically logged in again totally transparently if there is a slot open again.

Without thinking too hard about it I believe this solution will give birth to other problems.

Edited away:
As I commented - 20 users - are you really solving the right problem?

Answer 2

You may wish to have a "lastactive" field on your session. When someone attempts to log in or otherwise create a session, you can query for all sessions that have been active within a period of time (say 15 minutes), and use the resulting count to tell you how many concurrent sessions are active.