1

Does anyone know how to limit the number of browser sessions for FBA users or how to immediately terminate browser sessions for an FBA user?

The problem context is that we're operating a SharePoint 2016 Internet facing web app that has both AD and forms based authentication. We undergo continual ethical hacking analysis and we're seeing that if a user has multiple browser sessions open (IE and Chrome for example) and they change their password in one session, they can continue to operate in the other.

We'd like to modify our change password code to remove all the user tokens and force logon across all their sessions. Surprised we cannot find a way. Apparently if we were in cloud SP Online we could.

Improve this question

1 Answer 1

Reset to default
1

SharePoint Server does not have any mechanism to do this (only to manage the overall lifetime of all user's FBA cookies). You may want to consider placing a service in front of SharePoint that handles user authentication which can kill sessions on demand.

Improve this answer
1
  • Thanks for the fast reply. Everything I've read so far, points in this direction. I thought I'd better put the question hour here in case somebody has some ingenious work around.
    – David Vickery
    Commented Feb 1, 2021 at 12:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.