MVC下的Web API限制同一账号同时登录多台设备
原理：设备A成功登录后，会以当前会话的SessionID作为键，用户id作为值，保存在application（保存在服务器的全局变量，多用户可以共享）变量中。设备B用同账号登录后会判断application里是否已存在用户id作为值的数据，存在则将该值设为“_offline_”。设备A再在请求交互操作后，后端每次会判断SessionID作为键的值是否为“_offline_”，是则弹出该账号在异地登录，跳回登录界面。
后端处理登录的代码(登录在Web API里写的)：
private string loginin(string content)
{
string returnStr = "";
JLogin login = JsonConvert.DeserializeObject<JLogin>(content);
JHUserBL userBL = new JHUserBL();
JGetUser user = userBL.IsLogin(login.login_name, login.password);
if (user != null)
{
#region 存储登录的SessionID
HttpContext httpContext = System.Web.HttpContext.Current;
var userOnline = (Hashtable)httpContext.Application["Online"];
if (userOnline != null)
{
IDictionaryEnumerator enumerator = userOnline.GetEnumerator();
while (enumerator.MoveNext())
{
if (enumerator.Value != null && enumerator.Value.ToString().Equals(user.id.ToString()))
{
userOnline[enumerator.Key.ToString()] = "_offline_";
break;
}
}
}
else
{
userOnline = new Hashtable();
}
HttpContext.Current.Session.Timeout = 60 * 24;//1天
userOnline[HttpContext.Current.Session.SessionID] = user.id.ToString();
httpContext.Application.Lock();
httpContext.Application["Online"] = userOnline;
httpContext.Application.UnLock();
#endregion
returnStr = JsonHelper.RequestSuccess(JsonConvert.SerializeObject(user));
new JHLogBL().Insert(LogType.login, "用户登录", user.id);
}
else
{
returnStr = JsonHelper.RequstFail();
}
return returnStr;
}
后端处理异常登录的代码（LoginCheckFilterAttribute.cs下）：
using System;
using System.Collections;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.Mvc;
namespace GDSMPlateForm
{
public class LoginCheckFilterAttribute:ActionFilterAttribute
{
//表示是否检查登录
public bool IsCheck { get; set; }
//Action方法执行之前执行此方法
public override void OnActionExecuting(ActionExecutingContext filterContext)
{
base.OnActionExecuting(filterContext);
if (IsCheck)
{
#region 同一账号登录验证
HttpContext httpContext = System.Web.HttpContext.Current;
Hashtable userOnline = (Hashtable)httpContext.Application["Online"];
if (userOnline != null)
{
if (userOnline.ContainsKey(httpContext.Session.SessionID))
{
var value = userOnline[httpContext.Session.SessionID];
//判断当前session保存的值是否为被注销值
if (value != null && "_offline_".Equals(value))
{
//验证被注销则清空session
userOnline.Remove(httpContext.Session.SessionID);
httpContext.Application.Lock();
httpContext.Application["online"] = userOnline;
httpContext.Application.UnLock();
HttpCookie cookie = new HttpCookie("failLogin")
{
Value = "failLogin",
Expires = DateTime.Now.AddDays(1)
};
HttpContext.Current.Response.Cookies.Add(cookie);
HttpContext.Current.Request.Cookies.Remove("user_id");
//string msg = "下线通知：当前账号另一地点登录， 您被迫下线。若非本人操作，您的登录密码很可能已经泄露，请及时改密。";
filterContext.HttpContext.Response.Redirect("/");
}
}
}
#endregion
string req_method = filterContext.HttpContext.Request.HttpMethod;
if (req_method.ToLower() != "get" && req_method.ToLower() != "post" && req_method.ToLower() != "head")
{
GDSMCommon.LogHelper.WriteLog("平台请求方式有错:" + req_method);
filterContext.HttpContext.Response.Redirect("/error.html");
}
if (HttpContext.Current.Request.UrlReferrer != null)
{
if (HttpContext.Current.Request.Url.Host != HttpContext.Current.Request.UrlReferrer.Host)
{
GDSMCommon.LogHelper.WriteLog("跨站请求伪造：当前Host:" + HttpContext.Current.Request.Url.Host + ",上一个Host:" + HttpContext.Current.Request.UrlReferrer.Host);
filterContext.HttpContext.Response.Redirect("~/error.html");
}
}
string full_url = HttpContext.Current.Request.Url.ToString().ToLower();
if (full_url.Contains("content-type") || full_url.Contains("content-transfer-encoding") || full_url.Contains(";") || full_url.Contains("=_"))
{
GDSMCommon.LogHelper.WriteLog("参数请求错误：" + HttpContext.Current.Request.Url.ToString());
filterContext.HttpContext.Response.Redirect("~/error.html");
}
//else
//{
// GD.Common.LogHelper.WriteLog("跨站请求伪造：当前Host:" + HttpContext.Current.Request.Url.Host + ",上一个Host:不存在" );
// filterContext.HttpContext.Response.Redirect("~/error.html");
//}
string url = HttpContext.Current.Request.Url.AbsolutePath.ToString().ToLower();
if (url != "/" && url != "/home/index" && url != "/home/" && url != "/home" && url.Contains("afileupload") == false && url.Contains("classiccase") == false && url.Contains("h5template") == false && url.Contains("registeragree") == false && url.Contains("bannerupload") == false)
{
校验用户是否已经登录
//if (filterContext.HttpContext.Session["UserInfo"] == null)
//{
// //跳转到登陆页
// filterContext.HttpContext.Response.Redirect("/?tourl=" + HttpContext.Current.Server.UrlEncode(HttpContext.Current.Request.Url.ToString()));
//}
if (HttpContext.Current.Request.Cookies["user_id"] == null)
{
filterContext.HttpContext.Response.Redirect("/?tourl=" + HttpContext.Current.Server.UrlEncode(HttpContext.Current.Request.Url.ToString()));
}
else
{
if (HttpContext.Current.Request.Cookies["user_id"].Value == "")
{
HttpCookie cookie = HttpContext.Current.Request.Cookies["user_id"];
cookie.Expires = DateTime.Now.AddDays(-1);
HttpContext.Current.Request.Cookies.Add(cookie);
filterContext.HttpContext.Response.Redirect("/?tourl=" + HttpContext.Current.Server.UrlEncode(HttpContext.Current.Request.Url.ToString()));
}
}
}
}
}
}
}
然后在首页处理重复登录的状态：
$(function () {
var failLogin = getCookie("failLogin");
var user_id = getCookie("user_id");
if (failLogin != "" && user_id != "") {
var msg = "下线通知：当前账号另一地点登录， 您被迫下线。若非本人操作，您的登录密码很可能已经泄露，请及时改密。";
layer.open({
content: msg,
end: function () {
document.cookie = "failLogin=";
delCookie("user_id");
}
});
}
});
在MVC的WebApi中默认是没有开启Session会话支持的。需要在Global中重写Init方法来指定会话需要支持的类型
public class WebApiApplication : System.Web.HttpApplication
{
public override void Init()
{
this.PostAuthenticateRequest += (sender, e) => HttpContext.Current.SetSessionStateBehavior(SessionStateBehavior.Required);
base.Init();
}
}在WebApiConfig中建立建立HttpControllerHandler和HttpControllerRouteHandler 并覆写它，同时Routes.MapHttpRoute要修改为下面的格式
public static class WebApiConfig
{
public static void Register(HttpConfiguration config)
{
// Web API 配置和服务
// Web API 路由
//config.MapHttpAttributeRoutes();
//config.Routes.MapHttpRoute(
// name: "DefaultApi",
// routeTemplate: "api/{controller}/{id}",
// defaults: new { id = RouteParameter.Optional }
//);
RouteTable.Routes.MapHttpRoute(
name: "DefaultApi",
routeTemplate: "api/{controller}/{action}/{id}",
defaults: new { id = RouteParameter.Optional }
).RouteHandler = new SessionControllerRouteHandler();
}
public class SessionRouteHandler : HttpControllerHandler, IRequiresSessionState
{
public SessionRouteHandler(RouteData routeData)
: base(routeData)
{
}
}
public class SessionControllerRouteHandler : HttpControllerRouteHandler
{
protected override IHttpHandler GetHttpHandler(RequestContext requestContext)
{
return new SessionRouteHandler(requestContext.RouteData);
}
}
}
SessionID每次请求一直会变的情况，Global页面下需要添加Session_Start方法
using System;
using System.Collections;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.Http;
using System.Web.Mvc;
using System.Web.Optimization;
using System.Web.Routing;
using System.Web.SessionState;
namespace GDSMPlateForm
{
public class MvcApplication : System.Web.HttpApplication
{
protected void Application_Start()
{
AreaRegistration.RegisterAllAreas();
GlobalConfiguration.Configure(WebApiConfig.Register);
FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters);
RouteConfig.RegisterRoutes(RouteTable.Routes);
BundleConfig.RegisterBundles(BundleTable.Bundles);
}
void Session_Start(object sender, EventArgs e)
{
// Code that runs when a new session is started
}
void Session_End(object sender, EventArgs e)
{
// Code that runs when a session ends.
// Note: The Session_End event is raised only when the sessionstate mode
// is set to InProc in the Web.config file. If session mode is set to StateServer
// or SQLServer, the event is not raised.
}
}
public class WebApiApplication : System.Web.HttpApplication
{
public override void Init()
{
this.PostAuthenticateRequest += (sender, e) => HttpContext.Current.SetSessionStateBehavior(SessionStateBehavior.Required);
base.Init();
}
void Session_Start(object sender, EventArgs e)
{
// Code that runs when a new session is started
}
void Session_End(object sender, EventArgs e)
{
// Code that runs when a session ends.
// Note: The Session_End event is raised only when the sessionstate mode
// is set to InProc in the Web.config file. If session mode is set to StateServer
// or SQLServer, the event is not raised.
}
}
}
