Single login

Questions
1

I want to configure single login. I used AllowConcurrentLogins = false but that is not enough. I want if device A logs in. when device B logs in, device A should be logged out immediately, or at least when user does something on device A then it should be logged out. Currently it is waiting for about 1 minute to automatically log out on device A. Please, help me

2

Can I ask why does it need to be immediate? Are you able to still make changes within that minute? I’m wondering if the API will block device A in your scenario.

1 Like
3

My experience is that when AllowConcurrentLogins is false that the other one is kicked out very fast.

1 Like
4

I’m not sure if it’s really “waiting one minute” to kick out the device, or the client side application phones home and discovers it’s been kicked out and that takes a few seconds to happen.

I’m also interested to know if anything (like an API call) would be rejected in this time frame.

1 Like
5

I need to log out immediately, because it currently allows accounts on 2 devices to operate normally. The first device only logs out after about 1 minute of me doing nothing.

6

Just when I do nothing after about 1 minutes. If I do any thing, it won’t logout.

7

Currently, nothing is rejected in this frame. And I hope it will be rejected.

8

Please. I help me

9

What’s your exact Umbraco version?

10

Just did a few tests on v13.7.2, and I’m seeing the same behavior

Using a clean Umbraco installed based on this PSW setup: Package Script Writer

Test 1

  1. Logged in on my main browser
  2. Logged in on another browser and started a stopwatch

After 3 tests, I observed that my original session was logged out after 52s, 43s and 40s.

Test 2

I then tested to see if I could delay this logout by clicking/interacting as described=

  1. Logged in on my main browser
  2. Logged in on another browser and started a stopwatch
  3. Clicked between the Content and Media sections on my original session for 2 minutes

The result of this test was that my original session was not logged out until 48 seconds after I had stopped clicking between the sections. Therefore it seems that interacting with the original session does delay the logout.

So yea, something definitely feels off here.

3 Likes
11

Yep. I’m using v13.7.2. What you describe is the problem I’m having. Can anyone help me fix it?

12

@owainjones.dev Thanks for this! I’ll do some testing on it soon myself (as it is a security feature and all :eyes:).

2 Likes
13

Thanks. I resolved it. Like that:

builder.Services.Configure<BackOfficeSecurityStampValidatorOptions>(options =>
{
    options.ValidationInterval = TimeSpan.FromSeconds(5);
});