防止同一用户名的多个连接
我正在使用提供的 ASP.NET SQL Membership &我的应用程序中的角色提供者。
如何防止同一用户使用相同的凭据从不同的工作站登录？我可以想象为此使用 IP 地址，但我真的不知道从哪里开始......
另外，同一路由器后面的用户又如何呢？有没有办法阻止他们从不同的客户端 PC 进行访问？
I am using the provided ASP.NET SQL Membership & Role providers in my application.
How can I prevent that the same user does login from different workstations using the same credentials? I can imagine to use the IP address for this but I dont really know where to start from...
Also what about users behind the same router? Is there a way to prevent them access from different client PC's?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
IP 并不是一个很好的方法，因为典型公司 LAN 后面的所有用户在您看来都是从同一个 IP 进行连接的。解决方法是注销使用相同凭据登录的用户，从而仅保留最新登录的用户。这可以通过在应用程序或数据库中保留登录用户的 ID 或名称来实现。新用户会话启动后，立即检查该用户是否存在于应用程序/数据库中。如果是这样，请将其标记为脏的。在页面中，检查应用程序中是否存在用户 ID/名称，如果用户被标记为脏，则调用注销。这可以在站点/应用程序中的所有页面继承的 BasePage 中实现。
IP would not be a very good way as all users behind a typical company LAN would appear to you as connecting from the same IP. A workaround is to logout the user that is logged in with the same credential thus keeping only the latest one logged on. This can be achieved by keeping the logged in user's ID or name in Application or DB. As soon as a new user session is started, check if the user is present in Application/DB. If so, mark it dirty. In the pages, check the presence of UserID/Name in the Application and if the user is marked as dirty, invoke a logout. This can be implemented in a BasePage that all the pages within the site/app inherit from.
也许您可以存储用于唯一标识用户的任何内容，例如 ApplicationState< 中的 UserId /a> 并检查该值是否不为空。您可以在 SessionState 开始时将其 UserId 值添加到 ApplicationState，然后在 SessionState 结束时从 ApplicationState 中删除该值。
ApplicationState 对于 Web 应用程序来说是全局的，这意味着所有用户和会话都可以访问它，而 SessionState 的范围仅限于单个用户和会话。
Perhaps you can store whatever you are using to uniquely identify the user like a UserId in ApplicationState and check to see if that value is not null. You add their UserId value to ApplicationState at the start of SessionState and then at the end of SessionState remove that value from ApplicationState.
ApplicationState is global to the web application meaning it is accesible to all users and sessions while SessionState is limited in scope to a single user and session.