How to restrict user from same Username and Password to logic from two system/browser in asp.net mvc 4.0?

Question

I've created a asp.net mvc4 web site. I've implemented Form authentication also. In this web site i want to block access to my web site client in a same time (if a client of my website is already open his or her account in a computer then that client can not get any permission to open that same website on the same time in other computer or any other browser of the same system).

I want to provide one paid service to user, and I don't want him to just share his username and password with many people to use my service simultaneously without paying for it. please help me soon

How can I implement this. do i need to maintain some login information in database or is there any built in tool available for this.

Answer 1

To my knowledge there is nothing built in, but you may be able to implement your own version of the ASP.NET authorization providers .

Upon successful login you would need to store the value of the FormsAuthenticationTicket in your database and associate it to your user record.

On every page load you would need to check the value of the ticket against the database record for that user. In case of mismatch the user would be logged out.

Using this approach if User A and User B were using the same credentials, User A was logged in and if User B then logged in, it would invalidate User A's session and they would not be able to view content at the same time. You could also log the activity when a session is overridden, along with IP address and User Agent to help you identify users that are sharing account details.

Answer 2

This feature is not built in.

I would add an "IsLoggedIn" bit column to my "User" table. Then you could check this column to see if the user should be allowed in.

The problem is going to be knowing when that flag should be set to false. It's easy enough to set the flag to false if the user clicks "logout" or in the "on session end" event, but I think you'll run in to cases where that's not good enough. For example, if a user logs in from a laptop and the laptop's battery fails, you aren't going to get any notification from the client that the user has left...

Answer 3

我认为大卫已经给出了大部分的想法（+1），但是对于关闭浏览器而不注销的问题，您可以在window.unload()事件中处理它以在表中设置标志。