How to prevent simultaneous login with same user on different pcs

Question

We have build a intranet application where users have to login to do certain tasks... We have to make sure that no "application user" is logged in more than once at the same time.

So what I do at the moment is that I store the current asp .net session id in the database and then i compare at every page load wheter they are same or not. The session id is stored in the database when the user logs in.

But by using this kind check, there is always a database select needed. So I don't like this way very much. There must be a more elegant way to solve this, or?

We use ASP .Net2, C#..

Thanks in advance for any input

[Info Update]

I have already created a custom Membershipprovider and a custom Membershippuser. The Membershipuser has a method called "StartSession(string sessionId)" which is used, when the user logs in.

The other method CheckSession(string sessionId) is used at every postback, and it compares the current session id with the session id stored in the database.

[Update] Thanks everybody for your input. I will now use the cache to prevent permanent database access. I first thought that there is already a Class or something that is already handling this problem.

Answer 1

Your existing approach of storing this info in the DB is reasonable, it helps if things scale up.

However you could also use the System.Web.Caching.Cache object to track a users current session as well. If finding the info in the cache object fails fall back to reading it from the DB then place that info in the cache for the benefit of subsequent requests.