Handling Concurrent Login Sessions

Enforce session limits to prevent account sharing.

In this lesson, you will learn how to enforce session limits to prevent account sharing by restricting users to a single active session at any given time.

Why Limit Sessions?

While providing a great user experience is important, "account sharing"—where multiple people use the same credentials—poses a significant security risk. By enforcing a one-session-per-user policy, you ensure that if a legitimate user logs in from a new device or browser, their previous session is invalidated. This serves as a strong deterrent against credential sharing and helps identify unauthorized account access.

The Mechanism: Security Stamps

In ASP.NET Core Identity, the most efficient way to handle concurrent sessions is by utilizing the SecurityStamp. Every user has a unique SecurityStamp stored in the database. When a user authenticates, this stamp is stored in their encrypted authentication cookie.

The authentication middleware validates this stamp against the database on every request. If you change the user's SecurityStamp, all existing authentication cookies immediately become invalid because their stored stamp no longer matches the current one in the database.

Implementation Logic

To enforce a "kick off the old session" policy, you can update the stamp during the login process:

// Inside your Login Action
var user = await _userManager.FindByNameAsync(model.Email);

if (user != null)
{
    // Update the security stamp to invalidate all previous sessions
    await _userManager.UpdateSecurityStampAsync(user);

    // Proceed with standard sign-in
    await _signInManager.SignInAsync(user, isPersistent: false);
}

By calling UpdateSecurityStampAsync upon a successful login, you effectively "boot" any other active sessions associated with that account. The next time a user on a different device attempts to access a protected resource, the middleware will detect that their cookie's stamp is outdated and force them to re-authenticate.

This approach is highly performant because it leverages existing Identity plumbing rather than forcing you to manage manual session tracking tables or complex state stores.

Key Takeaway: By updating the user’s SecurityStamp during each successful login, you invalidate all prior authentication cookies, effectively enforcing a single-session policy.