ASP.NET：如何防止并行多次打开同一站点？
我是 ASP 的新手，我遇到了最糟糕的开发人员噩梦：我收到了被解雇的大型 ASP.NET 项目，我必须对其进行一些更改。其中一项更改是防止在一次 Active Directory 登录中多次打开同一站点（不同的选项卡、浏览器等...） 我注意到该应用程序正在使用会话。有什么想法可以使用会话来防止同一站点的多个实例吗？
I'm a newbie in ASP and I've encountered worst developer nightmare: I've received fired worker huge ASP.NET project and I must make some changes on it. One of the changes is to prevent opening same site few times on one Active Directory login (different tabs, browsers, etc...)
As I've noticed that app is using session. Any ideas to use session to prevent multiple instances of the same site?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这是一个想法。使用带有 GUID 的隐藏字段，该字段将由服务器为每次页面加载随机生成。当请求到达服务器时，它会检查传入的 GUID 是否是上次生成的 GUID。如果它不同或为空（当会话处于活动状态时）- 重定向到某个显示访问被拒绝的页面（此处没有新的 GUID）。如果正确，则提供请求的页面。这样做的小问题是，如果有人关闭浏览器并重新打开它，他/她在尝试再次使用您的应用程序时将被拒绝访问。为了最大限度地减少这种情况，您需要将会话超时降低到 1 分钟并使用 AJAX asp:Timer 来保持会话活动。请记住将保持活动调用（以及任何其他 AJAX 调用）排除在 GUID 生成/验证管道之外。当然，会话结束会重置该过程。此外，鼓励用户正确退出也是件好事。
这是实施起来相对简单的解决方案，尽管它的保护级别比永久连接弱。不过，对于非技术最终用户来说应该足够了 - 取决于您的“受众”。但即使对于了解该机制的人来说，使用两个应用程序“实例”也会变得相当困难。
如果你真的需要的话就去做吧。总的来说，我同意 Marc 的观点，即网络应用程序不应受到这种限制。也许这是一个受过教育的人的要求？
Here is an idea. Use a hidden field with GUID which would be randomly generated by server for each page load. When a request comes to the server it checks if GUID coming is what was generated last time. If it is different or empty (while session is alive) - redirect to some page saying access denied (no new GUID here). If it is correct, serve requested page. Small problem with this would be that if someone closes browser and reopens it he/she would get access denied when trying to use your app again. To minimize that you need to lower session timeout to 1 minute and use AJAX asp:Timer to keep session alive. Remember to exclude keep alive calls (and any other AJAX calls) out of GUID generation/verification pipeline. Of course end of session resets the process. Also it would be good to encourage users to properly log out.
This is relatively simple solution to implement although it is weaker in level of protection than permanent connection. Should be enough for non-technical end users though - depends on your "audience". But even for someone who knows about the mechanism, it would make using two "instances" of application quite difficult.
Do it if you really need to. Generally I agree with Marc that web apps should not be restricted this way. Maybe it is a requirement from someone who can be educated?
您只需要从每个页面创建持久连接。如果浏览器在单个选项卡上从一个页面导航到另一个页面，那么您将始终拥有一个持久连接。如果您从同一用户获得两个并行持久连接，则该用户打开了一个新选项卡。
在母版页页脚中添加一个脚本，该脚本在不结束其响应（如长轮询）的页面上对服务器进行 ajax 调用。如果另一个 ajax 调用来自同一用户，而最后一个 ajax 调用已连接，则这是第二个选项卡。
您可能需要查看 SignalR 以获得持久连接。它应该能够根据浏览器功能在 Web 套接字或长轮询之间切换。
You just need to create a persistent connection from each page. If browser navigates from one page to another on a single tab then you'll have a single persistent connection at all times. If you get two parallel persistent connections from same user then the user opened a new tab.
In the master page footer add a script that does an ajax call to the server on a page that doesn't end its response (Like long polling). If another ajax call comes from same user while the last one is connected then this is a second tab.
You might want to checkout SignalR for persistent connection thing. It should be able to switch between web sockets or long polling based on browser capabilities.
您无法阻止 url 同时加载到多个浏览器或选项卡中，因为这是一个客户端启动的过程。
您可以实现持久连接（如 Hasan Khan 的建议），以确保一次只有一个浏览器窗口可以处于活动状态。我想补充一点，当打开一个新窗口时，您可以警告用户他们已经有一个打开的连接。如果他们选择使用新连接，那么您将向旧连接（不同的浏览器、选项卡等）发送一条消息，这将导致该用户清除浏览器窗口。
You cannot prevent the url from being loaded in multiple browsers or tabs at one time, since this is a client-initiated process.
You could implement a persistent connnection (as suggested by Hasan Khan) to ensure that only one browser window can be active at a time. I would add on to that that when a new window is opened up, you could warn the user that they already have an open connection. If they choose to use the new connection, then you send a message down to the old connection (different browser, tab, etc) that will cause it to clear the browser window for that user.