asp.net 如何使另一个会话的会话过期
我有一个要求，如果用户登录到应用程序，则应注销具有同一用户的任何会话，即如果同一用户尝试从不同的 IP 登录到应用程序，则应在用户登录时关闭第一个会话。
I have a requirement in which if a user log in to application, any session with same user should be logged off i.e. if same user tries to login to application from different IP, then the first session should be closed when user logs in.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
不幸的是，ASP.NET 的本质意味着您无法判断用户是否已经登录。当然，您可以记录用户访问您的应用程序的事实，但没有办法告诉他们已经放弃了旧会话（也许可以通过关闭浏览器），并且他们的新登录是有效的。
你必须实现你自己的方法，
看看下面的：
http://geekswithblogs.net/Frez/articles/preventing-a-user-from-having-multiple-concurrent-sessions.aspx
Unfortunately, the nature of ASP.NET means that you cannot tell if a user is logged in already. Sure you can log the fact a user has accessed your application, but there is no way to tell that they have abandoned their old session, perhaps by closing their browser, and that their new login is therefore valid.
you have to implement your own method
have a look at the below:
http://geekswithblogs.net/Frez/articles/preventing-a-user-from-having-multiple-concurrent-sessions.aspx
如果您将最新使用的 IP 存储在数据库中，则所有会话都可以在下一页加载或任何处理程序调用时检查它们的请求是否来自同一 IP，如果不是，您可以调用 Session.Abandon();< /代码>
if you store the latest used IP in the database all the sessions could check at the next page load or any handler calls if their Request comes from the same IP or not and if not you can call
Session.Abandon();我认为在他们真正尝试做某事（即提出新请求）之前，您将无法将他们注销。
我的建议是始终存储“最后使用的 session_id”以及用户发出的每个请求的时间戳。
如果针对特定用户的下一个请求具有不同的 session_id，您知道他们刚刚再次登录，因此您不应再接受来自旧 sessionid 的请求，并且您可以删除他们的会话，然后将其重定向到错误页面
I don't think you will be able to log them out until they actually try do something, i.e. make a new request.
My suggestion would be to always store the "last session_id used" along with a timestamp with each request a user makes.
If the next request that comes in for a particular user has a different session_id, you know they just logged in again, so you should no longer accept requests from the old sessionid and you can delete their session and then redirect them to an error page
请参考：
当同一个用户 ID 尝试在多个设备上登录时，如何终止另一台设备上的会话？
您必须实现自己的解决方案，正如 @Massimiliano 上面所说。
我有类似的要求，并提出了一个非常巧妙的解决方案，如上面的链接所示。简而言之，我的要求是一次只能有一个用户登录。如果同一个用户 ID 尝试在其他地方登录，那么它会通过检查不同会话 ID 下的现有登录来终止第一次登录的会话（这使得该用户 ID 能够从其多个实例登录）计算机上的 Web 浏览器 [相同的会话 ID]，这很常见，但不是来自不同的计算机 [不同的会话 ID]（例如，可能是由于有人窃取了他们的凭据））。通过修改代码，您可能会更改其行为 - 即，阻止第二次登录尝试，而不是终止已经处于活动状态并正在使用的第一次登录。
当然，它可能无法 100% 满足您的需求，因此请随意修改它以满足您的需求。
Please refer to:
When the same user ID is trying to log in on multiple devices, how do I kill the session on the other device?
You'll have to implement your own solution, as @Massimiliano said above.
I had a similar requirement, and came up with a pretty slick solution, demonstrated in the link above. In a nutshell, my requirement was to only have one user log-in happening at one time. If that same user ID tried to log in elsewhere, then it killed the session for the first log-in by checking for an existing log-in under a different Session ID (this enabled the user ID to be logged in from multiple instances of their web browser on their computer [same Session ID], which is common, but not from a different computer [different Session ID] (possibly due to someone that stole their credentials, for example)). Through modification of the code you could probably change the behavior of this - i.e., prevent the second log-in attempt instead of killing the first log-in that's already active and in use.
Of course, it may not fit 100% to what you're needing, so feel free to modify it to fit your needs.