title: Prevent multiple logins
body: <p>I am trying to block multiple logins with the same user in my application. <br> My idea is to update the security stamp when user signin and add that as a Claim, then in every single request comparing the stamp from the cookie with the one in the database. This is how I've implemented that:</p>
  
  <pre><code>        public virtual async Task&lt;ActionResult&gt; Login([Bind(Include = "Email,Password,RememberMe")] LoginViewModel model, string returnUrl)
      {
          if (!ModelState.IsValid)
          {
              return View(model);
          }
  
          SignInStatus result =
              await SignInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, false);
          switch (result)
          {
              case SignInStatus.Success:
                  var user = UserManager.FindByEmail(model.Email);
                  var id = user.Id;
                  UserManager.UpdateSecurityStamp(user.Id);
                  var securityStamp = UserManager.FindByEmail(model.Email).SecurityStamp;
                  UserManager.AddClaim(id, new Claim("SecurityStamp", securityStamp));
  </code></pre>
  
  <p>Then in authentication configuration I've added </p>
  
  <pre><code>        app.UseCookieAuthentication(new CookieAuthenticationOptions
          {
              AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
              LoginPath = new PathString("/Account/Login"),
              Provider = new CookieAuthenticationProvider
              {
                  OnValidateIdentity = ctx =&gt;
                  {
                      var ret = Task.Run(() =&gt;
                      {
                          Claim claim = ctx.Identity.FindFirst("SecurityStamp");
                          if (claim != null)
                          {
                              var userManager = new UserManager&lt;ApplicationUser&gt;(new UserStore&lt;ApplicationUser&gt;(new ApplicationDbContext()));
                              var user = userManager.FindById(ctx.Identity.GetUserId());
  
                              // invalidate session, if SecurityStamp has changed
                              if (user != null &amp;&amp; user.SecurityStamp != null &amp;&amp; user.SecurityStamp != claim.Value)
                              {
                                  ctx.RejectIdentity();
                              }
                          }
                      });
                      return ret;
                  }
              }
  
          });
  </code></pre>
  
  <p>As it shows I have tried to compare the claim from the cookie with the one in the database and reject the identity if they are not the same.<br> 
  Now, each time the user signs in the security stamp gets updated but the value is different in user's cookie which I can't find out why? I am suspicious maybe it the new updated security stamp doesn't get stored in user's cookie?</p>