User session management in asp.net

Question

Hi, my client has had a security audit of a system I built for them complete.

They want it to work in such a way that if a user logs in via Internet Explorer that when they login via Firefox on the same machine (or via IE on another machine) that it kills the first session.

Essentially this means storing session info in the DB i would imagine and then setting an active/inactive flag against it so user id, session id, status if userid has an active session, then kill first session, and create new session.

Are there any built in mechanisms for doing this with the .NET framework or can anyone point me in the direction of some tutorials etc.

Many thanks,

Ed

Answer 1

First, add a field to your users table to store the currently used session ID. This ID is easily accessible from your code. When the user logs in, store that ID.

On every page request, check to verify that the current session ID matches what was stored in your user table. If it doesn't match, then clear the current session data and kick the user back to the log in screen.

This will not stop the user from using multiple tabs in IE 7 because IE7 uses the same instance for each tab; but it will stop them from using multiple browser instances.

The reason why this will work is that each browser contains it's own cookie space. Session's are matched up server side based on a cookie value that stores the session id and is sent back to the server on each request.

Incidentally, this is not a very effective means of eliminating session hijacking; which it sounds like the security audit is trying to prevent. If you need to do that, update your question and I'll go further.

UPDATE

One way to stop session hijacking is to store a random number in the session and as a cookie on the browser. When the next request comes in, verify that the cookie and session values match. If they don't then reset the session id variable in your user table. This will force all sessions to log in again. For every page request (post / get) create a new random value. The downside is that pages can not be bookmarked; but that's probably acceptable.

Answer 2

I blogged about how I handle this. Basically the idea is we create a non-persistant cookie, which has a Guid.

We then store this tied to the userId in some place on the server (App Cache, DB etc...). We then have a poller which hits the server every couple of minutes, and if the cookie doesn't match the value, we log the user out.