Alex Rivera | Logout

How to force logout user when his/her username is changed by another user?

Asked 2012-09-11T23:16:34.893
13

In my application I am using Forms-Authentication to sign in and sign out users.

One functionality is admin can change the username of other users. In that case, I need to sign out the user whose username is changed.

If I do not, due to their cookies set before, they gain access to application and receive error messages (since their username does not exist and there are parts where I use their username for some functionality).

How can I force these users to log out using Forms-Authentication ?

UPDATE :

    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        string controller = filterContext.RouteData.Values["controller"].ToString();
        string action     = filterContext.RouteData.Values["action"].ToString(); ;
        // Below returns the previous username, which does not exist anymore in db.
        string userName = HttpContext.Current.User.Identity.Name;

        UnitOfWork unitOfWork = new UnitOfWork();

        if (!unitOfWork.UserRepository.UserExists(userName))
        {
            FormsAuthentication.SignOut();
            filterContext.HttpContext.Session.Clear();
            filterContext.HttpContext.Session.Abandon();
            // I am not using Roles.


        }
        unitOfWork.Dispose();
        base.OnActionExecuting(filterContext);

    }

In my customer global filter, I check whether user exist or not, if not I sign them out. However, it is not working. By working I mean they pass the authentication and gain access to application.

Thanks in advance.

Edit
Report

1 Answer

2

When a user needs to become invalidated you must add their details to some kind of internal static list.

Then on every page request (possibly using Application_BeginRequest) see if that current user is in that list, and if so to call FormsAuthentication.SignOut there-and-then.

It seems like a bit of a hack, but it's the best I can think of right now.

Note that removing a user-in-absentia's session state is another issue entirely.

answered 2012-09-11T23:35:04.523

Your Answer