Limit # of concurrent logins.

[Paul]

I have an ASP.NET application that I want to limit # of concurrent
logins. Has anyone done similar things before? I was trying to
increment a counter in the application and decrement the counter in
"Session_End". However, the "Session_End" will only work for InProc
session. So, is there any other approach?

Thanks,
Paul.

 

[Erik Funkenbusch]

I have an ASP.NET application that I want to limit # of concurrent
logins. Has anyone done similar things before? I was trying to
increment a counter in the application and decrement the counter in
"Session_End". However, the "Session_End" will only work for InProc
session. So, is there any other approach?

Because the web is asynchronous and stateless, there is no real way to
guarantee whether someone is just idle for a while, or they've closed their
browser. This means that if a user closes their browser accidentally (or
it crashes) and they try to log back in, you will deny them until some
specified timeout happens. Probably not what you had in mind.

One approach is to check whether another session has been started for that
user, and if it has, the dump the current user with an error message. That
may not be ideal, though.

 

[Paul]

Because the web is asynchronous and stateless, there is no real way to

guarantee whether someone is just idle for a while, or they've closed their
browser. This means that if a user closes their browser accidentally (or
it crashes) and they try to log back in, you will deny them until some
specified timeout happens. Probably not what you had in mind.

This could actually be avoid by saving the user's ID or something like
that in application. The real problem I'm having is that if
"Session_End" never got raised if the session was not maintained
through InProc . Then the user will never be out of the system.

 

[Paul]

Because the web is asynchronous and stateless, there is no real way to

guarantee whether someone is just idle for a while, or they've closed their
browser. This means that if a user closes their browser accidentally (or
it crashes) and they try to log back in, you will deny them until some
specified timeout happens. Probably not what you had in mind.

This could actually be avoid by saving the user's ID or something like
that in application. The real problem I'm having is that if
"Session_End" never got raised if the session was not maintained
through InProc . Then the user will never be out of the system.

 

[Rajesh CKR]

I am not sure if this will work for your situation

You could have a last page accessed time for each user and define number of
active users as :

people who have accessed a page in last n minutes...

Raj