How to force logout user when his/her username is changed by another user?

问题

In my application I am using Forms-Authentication to sign in and sign out users.

One functionality is admin can change the username of other users. In that case, I need to sign out the user whose username is changed.

If I do not, due to their cookies set before, they gain access to application and receive error messages (since their username does not exist and there are parts where I use their username for some functionality).

How can I force these users to log out using Forms-Authentication ?

UPDATE :

    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        string controller = filterContext.RouteData.Values["controller"].ToString();
        string action     = filterContext.RouteData.Values["action"].ToString(); ;
        // Below returns the previous username, which does not exist anymore in db.
        string userName = HttpContext.Current.User.Identity.Name;

        UnitOfWork unitOfWork = new UnitOfWork();

        if (!unitOfWork.UserRepository.UserExists(userName))
        {
            FormsAuthentication.SignOut();
            filterContext.HttpContext.Session.Clear();
            filterContext.HttpContext.Session.Abandon();
            // I am not using Roles.


        }
        unitOfWork.Dispose();
        base.OnActionExecuting(filterContext);

    }

In my customer global filter, I check whether user exist or not, if not I sign them out. However, it is not working. By working I mean they pass the authentication and gain access to application.

Thanks in advance.

回答1:

Here's what you do to force user to sign out:

public void UserPasswordChangedHandler()
{
  FormsAuthentication.SignOut();
  Roles.DeleteCookie();
  Session.Clear();
}

I don't think line by line explanation required, its self explanatory enough. Please let me know if I am mistaken.

Update

Straightforward answer to your additional question is to keep per user boolean tracking if his data was updated by admin and if yes - just redirect him to login page.

Please see following articles for forced logout using forms authentication information:

How can I force a user to log out
How can I force a log out of all users for a website,
ASP.NET forms authentication forced logout
How to log off multiple MembershipUsers that are not the current user

Update 2

Clearing cookies

HowTo: create and remove Cookies with ASP.NET MVC
How do you clear cookies in ASP NET MVC 3 and C#
How do I invalidate a bad authentication cookie

Hope this help you.

回答2:

When a user needs to become invalidated you must add their details to some kind of internal static list.

Then on every page request (possibly using Application_BeginRequest) see if that current user is in that list, and if so to call FormsAuthentication.SignOut there-and-then.

It seems like a bit of a hack, but it's the best I can think of right now.

Note that removing a user-in-absentia's session state is another issue entirely.

来源：https://stackoverflow.com/questions/12379215/how-to-force-logout-user-when-his-her-username-is-changed-by-another-user

标签

asp.net-mvc

forms-authentication