asp.net - 防止在 asp.net MVC 4 应用程序中多次登录

Question

系统一次需要单个用户登录。如果同时尝试多次登录，则用户会被阻止。我使用了 Cookie 身份验证，它将从客户端浏览器进行管理。

登录代码：

 [HttpPost]
        [ValidateAntiForgeryToken]
        public ActionResult Login(LoginViewModel oLoginViewModel)
        {
            try
            {
                bool Result = new UserBL().ValidateUser(oLoginViewModel.UserName, oLoginViewModel.Password);
                if (Result == true)
                {
                    FormsService.SignIn(oLoginViewModel.UserName, oLoginViewModel.RememberMe);
                    CreateAuthenticationTicket(oLoginViewModel.UserName);
                    return RedirectToLocal(Request.Form["returnUrl"]);
                }
                else
                    ViewBag.Error = "Invalid Username or Password / Due to simultaneous login you get blocked.";

                return View();
            }
            catch (Exception ex)
            {
                throw ex;
            }
        }

        public void CreateAuthenticationTicket(string username)
            {
    
                Users oUsers = new Users();
                oUsers.Email = username;
                oUsers.Role = "User";
                int sessionid = new UserBL().GetByUserName(username).UserId;
                string userData = JsonConvert.SerializeObject(oUsers);
                FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket(1,
    username,
    DateTime.Now,
    DateTime.Now.AddYears(1), // value of time out property
    false, //pass here true, if you want to implement remember me functionality
    userData);
                string encTicket = FormsAuthentication.Encrypt(authTicket);
                var isSsl = Request.IsSecureConnection; // if we are running in SSL mode then make the cookie secure only
                HttpCookie faCookie = new HttpCookie(FormsAuthentication.FormsCookieName, encTicket)
                {
                    HttpOnly = false,
                    Secure = isSsl,
                };
                faCookie.Expires = DateTime.Now.AddYears(1);
                Response.Cookies.Add(faCookie);
    
                //Login Repository Entry
                LoginsRepository oLogin = new LoginsRepository();
                oLogin.UserName = username;
                oLogin.SessionId = sessionid.ToString();
                oLogin.LoggedIn = true;
                oLogin.CreatedOn = Utility.CommonFunction.DateTime_Now();
                oLogin.IPAddress = HttpContext.Request.RequestContext.HttpContext.Request.ServerVariables["REMOTE_ADDR"];
                oLogin.Status = En_LoginStatus.SingleUser.ToString();
    
                new LoginRepositoryBL().Add(oLogin);
            }

我正在使用他们的 IP 地址保存每个用户登录，以检查用户多次登录。

登录后它重定向到主控制器，我从上面提到的数据库表 Loginsrepository 中检查了多个登录逻辑：

 public class HomeController : CustomerBaseController
{
    public ActionResult Index()
    {
        Users oUser = new Users();
        oUser = new UserBL().getActiveUser();
       
        // check to see if your ID in the Logins table has 
        // LoggedIn = true - if so, continue, otherwise, redirect to Login page.
        if (new LoginRepositoryBL().IsYourLoginStillTrue(System.Web.HttpContext.Current.User.Identity.Name, oUser.UserId.ToString()))
        {
            // check to see if your user ID is being used elsewhere under a different session ID
            if (!new LoginRepositoryBL().IsUserLoggedOnElsewhere(System.Web.HttpContext.Current.User.Identity.Name, oUser.UserId.ToString()))
            {
                Answers oAnswer = new Answers();
                return View(oAnswer);
            }
            else
            {
                // if it is being used elsewhere, update all their 
                // Logins records to LoggedIn = false, except for your session ID
                new LoginRepositoryBL().LogEveryoneElseOut(System.Web.HttpContext.Current.User.Identity.Name, oUser.UserId.ToString());
                Answers oAnswer = new Answers();
                return View(oAnswer);
            }
        }
        else
        {
            oUser = new UserBL().GetByUserName(System.Web.HttpContext.Current.User.Identity.Name);
            oUser.Status = En_Status.Inactive.ToString();
            new UserBL().update(oUser);

            FormsService.SignOut();
            FormsAuthentication.SignOut();
            return RedirectToAction("Login", "Account");
        }
    }
}

以上方法：

       public bool IsYourLoginStillTrue(string userId, string sid)
    {
        try
        {
            using (var ctx = new CnSiteEntities())
            {
                IEnumerable<LoginsRepository> logins = (from i in ctx.LoginsRepository
                                                        where i.LoggedIn == true &&
                                                        i.UserName == userId && i.SessionId == sid
                                                        select i).AsEnumerable();
                return logins.Any();
            }
        }
        catch (Exception)
        {

            throw;
        }
    }

    public bool IsUserLoggedOnElsewhere(string userId, string sid)
    {
        try
        {
            using (var ctx = new CnSiteEntities())
            {
                IEnumerable<LoginsRepository> logins = (from i in ctx.LoginsRepository
                                                        where i.LoggedIn == true &&
                                                        i.UserName == userId && i.SessionId != sid
                                                        select i).AsEnumerable();
                return logins.Any();
               
            }
        }
        catch (Exception)
        {

            throw;
        }
    }

    public void LogEveryoneElseOut(string userId, string sid)
    {
        try
        {

            using (var ctx = new CnSiteEntities())
            {
                IEnumerable<LoginsRepository> logins = (from i in ctx.LoginsRepository
                                              where i.LoggedIn == true &&
                                              i.UserName == userId &&
                                              i.SessionId != sid // need to filter by user ID
                                              select i).AsEnumerable();

                foreach (LoginsRepository item in logins)
                {
                    item.LoggedIn = false;
                }
                
                ctx.SaveChanges();
            }
        }
        catch (Exception)
        {

            throw;
        }
    }

它不能正常工作。即使多个同时登录，它也会在登录后保持真实。我已经用谷歌搜索并尝试了很多，但我没有得到任何解决方案。