title: What is the best practice for limiting ASP.NET user sessions to a single active session?
body: <p>I have a requirement where a logged-in user can only have 1 active session at a time in an ASP.NET application.  Currently a single user can log in from multiple machines simultaneously and get multiple sessions.  I am using standard ASP.NET Membership with AppFabric for session state management.  Am I missing some basic switch available in ASP.NET Membership to enforce this?  Otherwise, the plan was to add a table to the membership database that would have the aspnet_Users.UserId and sessionId columns and simply make sure that the current session Id (last-in) is the only session allowed.  Thanks for any help! </p>