Search code examples
c#asp.net-mvcforms-authentication

How to force logout user when his/her username is changed by another user?


In my application I am using Forms-Authentication to sign in and sign out users.

One functionality is admin can change the username of other users. In that case, I need to sign out the user whose username is changed.

If I do not, due to their cookies set before, they gain access to application and receive error messages (since their username does not exist and there are parts where I use their username for some functionality).

How can I force these users to log out using Forms-Authentication ?

UPDATE :

    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        string controller = filterContext.RouteData.Values["controller"].ToString();
        string action     = filterContext.RouteData.Values["action"].ToString(); ;
        // Below returns the previous username, which does not exist anymore in db.
        string userName = HttpContext.Current.User.Identity.Name;

        UnitOfWork unitOfWork = new UnitOfWork();

        if (!unitOfWork.UserRepository.UserExists(userName))
        {
            FormsAuthentication.SignOut();
            filterContext.HttpContext.Session.Clear();
            filterContext.HttpContext.Session.Abandon();
            // I am not using Roles.


        }
        unitOfWork.Dispose();
        base.OnActionExecuting(filterContext);

    }

In my customer global filter, I check whether user exist or not, if not I sign them out. However, it is not working. By working I mean they pass the authentication and gain access to application.

Thanks in advance.


Solution

  • Here's what you do to force user to sign out:

    public void UserPasswordChangedHandler()
    {
      FormsAuthentication.SignOut();
      Roles.DeleteCookie();
      Session.Clear();
    }
    

    I don't think line by line explanation required, its self explanatory enough. Please let me know if I am mistaken.

    Update

    Straightforward answer to your additional question is to keep per user boolean tracking if his data was updated by admin and if yes - just redirect him to login page.

    Please see following articles for forced logout using forms authentication information:

    Update 2

    Clearing cookies

    Hope this help you.