使用表单身份验证在 ASP.NET MVC3 中注销用户的其他会话
我正在使用表单身份验证构建一个 ASP.NET MVC3 应用程序，并且我想在该用户登录时注销该用户的所有现有会话。我试图阻止不同工作站上的多个人登录并在该用户下工作同一个帐户。
有处理这个问题的标准方法吗？注销现有会话很容易，但我还没有找到一种方法来检查同一帐户的其他会话并将其注销。
我对如何破解此问题有一些想法，但我很好奇是否有使用 IIS 或 FormsAuthentication API 的既定方法。
I am building an ASP.NET MVC3 app using Forms Authentication and I'd like to log out all existing sessions for a user when that user logs in. I'm trying to prevent multiple people at different workstations from logging in and working under the same account.
Is there a standard way of handling this? Logging out the existing session is easy, but I haven't come across a way to check for other sessions by the same account and log them out.
I have a few ideas on how to hack this, but I'm curious if there's an established method for this using IIS or the FormsAuthentication API.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
由于网络的无状态性，您无法“注销”会话，直到他们发出下一个请求为止（例如，会话可能保存在 cookie 中，该 cookie 无法在客户端上下文之外写入）请求-响应交互）。
还有一个解决方案，假设您正在使用会话状态，并且最好为所有需要“身份验证”的控制器提供一个通用的基本控制器。
成功登录后，生成一个令牌（可能是一个 guid）并将其与会话一起存储。还将其写入由用户 ID 键入的应用程序范围存储（例如数据库或应用程序上下文）。
在基本控制器中（或者您必须创建一个操作过滤器），根据在应用程序范围存储中为用户 ID 注册的令牌检查会话中的令牌。如果它们不匹配，请使用标准
SignOut()调用注销用户。Because of the statelessness of the web, you can't "log out" a session until they make their next request (for instance, session might be maintained in a cookie, which can't be written on the client outside of the context of a request-response interaction).
There is still a solution, which assumes you are using session state, and preferably you have a common base controller for all of your controllers requiring "Authentication".
Upon successful login, generate a token (a guid perhaps) and store that with the session. Also write this to a application-wide store (database or application context for instance) keyed by the userid.
In the Base Controller (or otherwise you'd have to create an action filter) check the token in session against the token registered for the userid in the application-wide store. If they don't match, log out the user using the standard
SignOut()call.您可以使用
Membership.IsOnline< /code>属性基于最后活动日期：You could use the
Membership.IsOnlineproperty which is based onLastActivityDate: