Force a logged in user to re-login by invalidating his session

Question

I have an ASP.NET MVC application running on IIS7. I use sessions to keep track of logged in users. There is a session named IsSignedIn. ("true" means this user is currently logged in).

I also have an administration page for my application.

Now, say user1 who is signed in already, must be suspended from using the service immediately. So I want to invalidate the session variables set for user1 from my administration page (this will force the user to sign in again).

Is there a way I can access/modify session variables set by each logged in user from my administration page?

Answer 1

You can not change a session variable from another session.

One way to solve your problem is to store a list of logged in users in the Application-object, and then change the value in that variable. For this to work you must check at the top of each page that this user is in the list of logged in users.

As çağdaş commented on this answer, performance would probably be better if you store a list of users you want to log out in your application-variable. Then on the top of your page do something like this (pseudo, this actuall code snippet will not work)

if(Application["SuspendedUsers"].Contains(Session["UserID"]) {
  Session["IsSignedIn"] = false;
  Application["SuspendedUsers"].Remove(Session["UserID"]);
}

Answer 2

Where is your session state stored? If it's in SQL server, you should be able to invalidate it by updating the relevant row in the database. The standard session state server, however, doesn't appear to allow this.

Alternatively, check your database at the top of each relevant page to see if the user still has rights/is authenticated.