Preventing concurrent logins using same credentials

A few days back I faced a problem which made me go back and forth a couple of times over the code which I had written, and my work process was virtually ceased. The problem was regarding user login, i.e. “How can I be able to prevent concurrent user login using the same credentials from different machines”

Well, as I have found the solution I would like to share it with you all.



If we are using Membership Providers to store the user credentials, then we can use the IsOnline property of MemebershipUser Class to check if it’s a concurrent login or not. If the user logins with a username and password, then it is checked that the user is online or not, if he / she is not online(that means there is no concurrent login) then he / she is allowed, otherwise the user is redirected to another page.

Add this code to the LoggedIn() event of the Login control, which is raised after the user is authenticated  or in you Login Button click.
 
 

protected void logctrlLoginPage_LoggingIn(object sender, EventArgs e)

        {

            MembershipUser GetUser = Membership.GetUser(User.Identity.Name, false);

            if (GetUser.IsOnline)

            {

                Response.RedirectPermanent("~/NotAllowed.aspx");

            }

        }

And make changes to the Membership tag in web.config as this,

 

<membership defaultProvider="AspNetSQlMembershipProvider" userIsOnlineTimeWindow="1">

A user is considered online if the current date and time minus the UserIsOnlineTimeWindow property value is earlier than the LastActivityDate for the user. The LastActivityDate for a user is updated to the current date and time by the CreateUser, UpdateUser and ValidateUser methods, and can be updated by some of the overloads of the GetUser method.