Quantcast
Channel: Security
Viewing all articles
Browse latest Browse all 4737

logout all other users browser login sessions except the one user resets his password

$
0
0

Hi

I configured CookieAuthenticationOptions as below :

 app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
                LoginPath = new PathString("/Account/Login"),
                //ExpireTimeSpan = TimeSpan.FromHours(1),
                SlidingExpiration = true,

                Provider = new CookieAuthenticationProvider
                {
                    // Enables the application to validate the security stamp when the user logs in.
                    // This is a security feature which is used when you change a password or add an external login to your account.  
                    OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser, int>(
                        validateInterval: TimeSpan.FromMinutes(1),
                        regenerateIdentityCallback: (manager, user) => user.GenerateUserIdentityAsync(manager),
                        getUserIdCallback: (id) => (id.GetUserId<int>())),

                }
            });

Whenever a user resets his/her password, his login in other browsers will be invalidated and user should try to login again. But I don`t want the user to login again in a browser he already changed password with, and only other browsers session get invalidated. Is it possible ? Or I should redirect user to login page ? 


Viewing all articles
Browse latest Browse all 4737

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>