Odtnhj

I am working on asp.net mvc project.The project is working amazingly on localhost.However when i upload the project on a server , i am facing some issues.I login from a machine it is getting logged in successfully.Then i try to login as another user it works.Now i go to previous user login and i refresh the page the second user login takes over the 1st user login.In general,the previous user login is replaced by recent/latest user login.I searched a lot about this issue but couldn't find anything.Please share some suggestions regarding this issue.

I have a controller named AuthenticateController which has the actions as
Login and Logout.I have tried implementing session but no luck.Here is the code.Please help me with proper session implementation code if possible or if there are any changes i need to make in my code.It would be great if there is another way of achieving authentication with proper login logout and back button issue.Thanks in advance!!

public class AuthenticateController : Controller

 DBEntities entity = new DBEntities();

 public static int userid = 0;
 public static string getreference = string.Empty;

 public ActionResult Login()
 
 return View();
 

 [HttpPost]
 public ActionResult Login(AuthenticateModel model)
 
 try
 
 var check = entity.TblName.Where(x => x.UserName == model.UserName && x.Password == model.Password).ToList();
 if (check.Count > 0)
 
 foreach (var r in check)
 
 GlobalVaribale.UserId = r.UserId;
 //FullName
 GlobalVaribale.UserName = r.FullName;
 GlobalVaribale.UserAccessLevel = r.AccessLevel.Value;
 GlobalVaribale.OrgId = r.OrganisationId.Value;
 Session["UserId"] = r.UserId;
 Session.Timeout = 10;

 
 return RedirectToAction("Index", "Home");
 
 else 
 
 TempData["Wrong"] = "Invalid Credentials";
 return View();
 
 
 catch (Exception e)
 
 Console.WriteLine(e);
 return View();
 

 

 public ActionResult Logout()
 
 Session["UserId"] = null;
 Session.Abandon();
 GlobalVaribale.UserId = 0;
 GlobalVaribale.UserName = string.Empty;
 GlobalVaribale.UserAccessLevel = 0;
 GlobalVaribale.OrgId = 0;
 return RedirectToAction("Login");
 

}

I have created a global folder in which i have a class named as GlobalVaribale.The code is given below

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;

namespace TimeSheet.Global

public static class GlobalVaribale

 public static int UserId = 0;
 public static int OrgId = 0;
 public static int UserAccessLevel = 0;
 public static string UserName = string.Empty;

 public enum AccessLevel
 
 admin = 1,
 management = 2,
 employee = 3,
 contractor = 4,
 superamin = 5
 

You have two problems. One is that you are using static variables in a web context, meaning they'll be shared between all visitors. Don't do that.

Your bigger problem is this:

var check = entity.TblName.Where(x => x.UserName == model.UserName && x.Password == model.Password).ToList();

You're rolling your own authentication logic. Definitely don't do that. Start over, use ASP.NET Identity and don't bother writing your own login code, because you're doing it wrong and opening up your users to security vulnerabilities.