Does SimpleMembership take user authentication away?

Question

I am creating a new MVC 4 website and I have a SimpleMembership setup. I also created a CustomPrincipal that inherits from RolePrincipal and has one additional property called UserInfo that contains additional information about the user, such as LastName, FirstName, and IsActive. This is all stored in a cookie through the UserData FormsAuthenticationTicket property.

My question is the following. Suppose I have a management page where an administrator can disable other user accounts - set the IsActive property to false. Suppose, at the same time, a user who is disconnected is actually currently logged in. I do not want this user to be able to continue navigating the site if he was denied his access rights.

How can I kill his session sense by breaking his FormsAuthentication cookie? Is this the right thing or something else in SimpleMembership that I am missing? What is the right way to achieve this? Any advice would be appreciated ...

Answer 1

I would suggest combining the use of Application_AuthenticateRequest and the ASP.NET cache, as shown below:

1) When the user is deleted, enter the user ID in the ASP.NET cache, where he can sit for a finite period of time (possibly one day):

string cacheKey = "RecentlyDeletedUserId" + userId; Cache.Add( cacheKey, true, null, DateTime.Now.AddDays(1), null, CacheItemPriority.Normal, null ); 

2) In global.asax, you can add an Application_AuthenticateRequest handler that runs for each request after the server successfully receives a forms authentication ticket. In this handler, you make one cheap cache request in memory to find out if this user is on the list of recently deleted users. If they are, you sign them up and redirect them to the login page.

 protected void Application_AuthenticateRequest(object sender, EventArgs e) { string cacheKey = "RecentlyDeletedUserId" + userId; if (Cache[cacheKey] != null) { FormsAuthentication.SignOut(); FormsAuthentication.RedirectToLoginPage(); } } 

If for some reason you don't like the redirect approach, you could use this approach:

 protected void Application_AuthenticateRequest(object sender, EventArgs e) { string cacheKey = "RecentlyDeletedUserId" + userId; if (Cache[cacheKey] != null) { IPrincipal anonymousPrincipal = new GenericPrincipal(new GenericIdentity(String.Empty), null); Thread.CurrentPrincipal = anonymousPrincipal; HttpContext.Current.User = anonymousPrincipal; } } 

This simply replaces the user with an anonymous user, which ensures that the user cannot do anything on your site. (This alternative approach applies to the Invalid ASP.NET FormsAuthentication server side .)