如何解决 ASP.NET、VB.NET 中的会话问题？
如何解决 ASP.NET、VB.NET 中的会话问题？
有以下要求：
当授权用户登录系统时，不允许该用户从其他计算机或除该用户当前使用权之外的其他浏览器登录。
我们采用的补救措施是：我们将“Is_Loggedin”作为数据类型为“bit”的列保留在 mst_vendor 中作为表名。当用户登录时，我们将标志 Is_Loggedin 设置为“1”，每次有人尝试使用此帐户登录时，系统都会显示错误“用户已登录。”。
当用户注销时，它会变为“0”，因为一旦用户单击注销按钮，就会调用注销过程。
问题场景：
当用户关闭浏览器时，标志保持不变，即“1”。
断电时，保持与“1”相同。
如果会话在预定义值之后超时，则保持不变。
可能存在除此之外的不同场景。
有什么方法可以让我们使用应用程序对象存储用户登录状态的内部标记吗？
它可以提高系统的效率并消除上述有问题的情况。
How to tackle this session problem in ASP.NET,VB.NET?
The following requirement are there:
When the authorized user logs into the system that user is not allowed to login from another computer or in different browser other than that user is using right at this time.
The remedy we applied was: We have kept "Is_Loggedin" as a column with data type "bit" in a mst_vendor as a table name. When a user logs in we set the flag, Is_Loggedin, to "1" and each time when someone tries to log in using this account, the system is showing the error "The user is already logged in.".
When the user logs out it turns to "0" as the logout procedure calls as soon as the user clicks the log out button.
Problem scenario:
When the user closes the browser the flag remains the same, that is, "1".
When power gets off, it remains the same as "1".
If the session timeouts after a predefined value it remains the same.
There may be different scenarios other than this.
Is there any way so that we can store this internal flagging for the user's login status using the application object?
It may improve efficiency of the system and also eliminates the above problematic scenarios.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
您应该使用
Global.asax文件并使用Session_End函数。Session_End: 当用户的会话超时、结束或离开应用程序网站。
You should use the
Global.asaxfile and use theSession_Endfunction.Session_End: Fired when a user's session times out, ends, or they leave the application Web site.
将日期时间存储为该位旁边的另一列，并在每次用户请求页面时更新它。
当新用户使用相同的凭据并且该位为“1”时，您可以检查日期时间，如果是不久前，您可以确定该用户不再存在。因此，让登录继续进行。
Store a datetime as another column next to the bit, and update it each and every time the user requests a page.
When a new user comes along with the same credentials and the bit is "1" you can check the datetime, and if it was a while ago you can be certain the user is no longer there. So let the login go ahead.
您可以在脚本中保持脉冲，当脉冲超时时，认为用户已完成该会话。
这样做的好处是您可以区分闲置在网站上的用户和离开网站的用户。
You could keep a pulse going in script, and when the pulse times out, consider the user finished with that session.
The benefit to this is that you can tell the difference between the user sitting idle on the site and the user leaving the site.
从最顶层的角度来看，您可以执行以下操作
使用带有 SlidingExpiration 的缓存。
每次用户尝试登录时，都会以其用户名作为密钥检查缓存。如果缓存中存在条目，则可以说用户已经登录并拒绝登录。
如果未找到该密钥，则允许登录并在缓存中创建一个新密钥作为用户名并设置滑动过期时间。 （应该仔细选择，因为这将是持续时间，在浏览器关闭并且用户尝试重新登录后，用户不会被锁定。）
在 Global 中的 Application_PreRequestHandlerExecute 处理程序中，检查用户当前是否处于活动状态（您可以为此使用会话），重置用户的滑动过期时间。这样，每次页面请求都会重置缓存过期时间。
如果用户关闭浏览器并离开，缓存将在设定的时间段后过期，并允许用户再次登录。
如果用户在缓存过期之前尝试再次登录，则用户必须等待一段时间才能让缓存过期。
如果用户正确注销，您可以删除注销事件上的缓存条目，这样用户就不必等待重新登录。
滑动过期超时可以与会话超时同步，以模拟应用程序的实际会话超时。
通过这种方法，您还可以节省大量数据库往返来更新/检查用户状态，并且无论托管环境或会话模式如何，这都可以工作。
From a very top level view, here is what you can do
Use Cache with SlidingExpiration.
Everytime a user attempts login, check the cache with his username as the key. If an entry exists in the cache, you can say that user is already logged in and deny login.
If the key is not found, allow login and create a new key in the cache as the username and set the sliding expiration time. (This should be carefully chosen as this would be the duration, the user wouldnt be locked out after the browser is closed and user attempts to relogin.)
In the Application_PreRequestHandlerExecute handler in Global, check if the user is currently active (you can use sessions for this), reset the sliding expiration time for the user. This way, with each page request the cache expiration time would be reset.
If the user closes the browser and moves off, the cache would expire after the set period of time, and would free the user to log in again.
if in case the user attempts to login again before the cache expires, the user would have to wait for some time to let the cache expire.
if the user logs off properly, you can remove the cache entry on the logoff event such that user doesnt have to wait to relogin.
The Sliding expiration timeout can be synced with session timeout to emulate the actual session timeout for the application.
With this approach, you would also save on a lot of database round trips to update/check the user status and this would work irrespective of the hosting enviornment or the session modes.
是的，脚本是个好主意。只需将会话超时设置为 5 分钟而不是 20 分钟，然后将一个方法写入
global.asax文件中的session.end来相应更新数据库。Yeah, a script would be a good idea. Just set the session timeout to be 5 minutes instead of 20 and then write a method into
session.endin theglobal.asaxfile that updates the database accordingly.