How to log out exiting user if a new user tried to login from another

To implement the functionality where logging in from a new device logs out the user from any previously logged-in device, you can follow these steps using cookie authentication:

1. Update the Authentication Scheme: Make sure your cookie authentication is set up to handle events, particularly the OnValidatePrincipal event, which can be used to validate the authentication ticket on each request.

   Here’s how you can configure this in your Startup.cs:

   services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
       .AddCookie(options =>
       {
           options.Events = new CookieAuthenticationEvents
           {
               OnValidatePrincipal = async context =>
               {
                   var userService = context.HttpContext.RequestServices.GetRequiredService();
                   var principal = context.Principal;
                   var userId = principal.FindFirst(ClaimTypes.NameIdentifier).Value;
                   var currentLoginInfo = await userService.GetLoginInfoAsync(userId);
   
                   if (currentLoginInfo == null || currentLoginInfo.IpAddress != context.Request.HttpContext.Connection.RemoteIpAddress.ToString())
                   {
                       context.RejectPrincipal();
                       await context.HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
                   }
               }
           };
       });

   In this code, IUserService should be a service that you define to interact with your user data storage. GetLoginInfoAsync is a method that should return the latest login record for a user, containing at least the user's ID and IP address.

2. Update Login Logic: Every time a user logs in, update the user's current session record in your database. This record should include the user ID, the current time, and the IP address of the device.

   Here’s a simple example of what the login might look like:

   public async Task Login(UserLoginModel model)
   {
       var user = await _authService.ValidateUserCredentialsAsync(model.Username, model.Password);
       if (user != null)
       {
           var claims = new List
           {
               new Claim(ClaimTypes.NameIdentifier, user.UserId.ToString()),
               new Claim(ClaimTypes.Name, user.Username)
           };
   
           var claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
           var authProperties = new AuthenticationProperties();
           await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(claimsIdentity), authProperties);
   
           await _userService.UpdateLoginInfoAsync(user.UserId, HttpContext.Connection.RemoteIpAddress.ToString());
   
           return Redirect("/");
       }
   
       ModelState.AddModelError("", "Invalid login attempt.");
       return View(model);
   }

3. Handle Logout on New Login: The code in the OnValidatePrincipal event will handle the logout by rejecting the principal if the current request comes from an IP address that doesn't match the latest recorded IP address for the user.

By setting up your application this way, you ensure that a user is automatically logged out from any previous sessions when they log in from a new device. This approach leverages the built-in mechanisms of cookie authentication in ASP.NET Core to handle session invalidation based on custom logic, which in this case, is the IP address stored during the last login.