Nullreferenceexception in User Filter

Question

In my project I made a filter to see if the user is already logged in. To prevent the same Log twice in the system.

According to the answer to my question I make a filter class and search the ID user in session and do all the checking in the database.

What happens is that I’m having a null reference error and I don’t quite know why. I’m passing the ID of the user in the session, but I am not able to capture it at the time of making this check, generating me this error:

Description: An untreated exception occurred during the execution of the current web request. Examine stack tracking for more information about the error and where it originated in the code.

Exception Details: System.Nullreferenceexception: Object reference not defined for an instance of an object.

And the error is being generated on this line:

var idDoUsuario = (long) filterContext.HttpContext.Session["UsuarioID"];  

At the level of more information, I will put the codes of the class I use filter and the action which I use for authentication.

Filter

 void IActionFilter.OnActionExecuting(ActionExecutingContext filterContext)
    {
        var contexto = new EntidadesContexto();
        // Recupero a Id do Usuário logado aqui.
        // Não sei como você está fazendo, então inventei um método
        var idDoUsuario = (long) filterContext.HttpContext.Session["UsuarioID"];           

        var usuario = contexto.Usuarios.FirstOrDefault(u => u.UsuarioID == idDoUsuario && u.Logado && u.SessionID != filterContext.HttpContext.Session.SessionID);

        if (usuario != null)
        {
            // Se o último login foi feito dentro do período de um dia
            if (usuario.UltimoLogin.AddDays(1) > DateTime.Now)
            {
                // Usuário logado em outro lugar.
                usuario.Logado = false;
                contexto.Entry(usuario).State = EntityState.Modified;
                contexto.SaveChanges();
                // Destrua aqui a Session do Usuário se houver uma.                    
            }
            else
            {
                filterContext.HttpContext.Session.Abandon();
                // O login do Usuário expirou.
                var controller = (MeuControllerBase)filterContext.Controller;                    
                filterContext.Result = controller.RedirectToAction("Index", "Autenticacao");                   
            }
        }

Authentication

 [FiltroSessao]
    [HttpPost]       
    public ActionResult Index(String Login, String Senha)
    {
        //verificando login pelo usuario do banco de dados ...
        Usuario login = db.Usuarios.Where(x => x.Login == Login && x.Senha == Senha).FirstOrDefault();
        if (login != null)
        {
            FormsAuthentication.SetAuthCookie(login.Nome.ToString(), false);
            Session.Add(".PermissionCookie", login.Perfil);
            Session.Add("UsuarioID", login.UsuarioID);

            login.Logado = true;
            login.UltimoLogin = DateTime.Now;
            login.SessionID = HttpContext.Session.SessionID;

            db.Entry(login).State = EntityState.Modified;
            db.SaveChanges();

            return RedirectToAction("Index", "Home"); //pagina padrao para todos os usuarios...
        }
        return RedirectToAction("Index");

    }

Just to highlight, I pass the ID user on this line:

Session.Add("UsuarioID", login.UsuarioID);

Any suggestions ?

Answer 1

From what I saw in your code, you keep a Ssion with the ID of the User just to recover in filter. It would not be possible to recover the User from the UserName? That way you wouldn’t need to manipulate a Session.

You can get the username of the logged in user by accessing filterContext.HttpContext.User.Identity.Name. If you need to test if the User is logged in, it is possible to check the value of filterContext.HttpContext.User.Identity.IsAuthenticated;

void IActionFilter.OnActionExecuting(ActionExecutingContext filterContext)
    {
        var contexto = new EntidadesContexto();

        var userName = filterContext.HttpContext.User.Identity.Name;           

        // estou assumindo que seu objeto Usuario possui a property UserName
        var usuario = contexto.Usuarios.FirstOrDefault(u => u.UserName == userName && u.Logado && u.SessionID != filterContext.HttpContext.Session.SessionID);

        if (usuario != null)
        {
            // Se o último login foi feito dentro do período de um dia
            if (usuario.UltimoLogin.AddDays(1) > DateTime.Now)
            {
                // Usuário logado em outro lugar.
                usuario.Logado = false;
                contexto.Entry(usuario).State = EntityState.Modified;
                contexto.SaveChanges();
                // Destrua aqui a Session do Usuário se houver uma.                    
            }
            else
            {
                // O login do Usuário expirou.
                var controller = (MeuControllerBase)filterContext.Controller;                    
                filterContext.Result = controller.RedirectToAction("Index", "Autenticacao");                   
            }
        }

Answer 2

From what I’ve researched, and from what I’ve seen of your code, [FiltroSessao] is running before you set the value of Session. There are two ways to solve:

• Change of:

  void IActionFilter.OnActionExecuting(ActionExecutingContext filterContext)
  

  To:

  void IActionFilter.OnActionExecuted(ActionExecutingContext filterContext)
  

• Do FiltroSessao receive parameters:

  namespace SeuProjeto.Filters 
  {
      public class UniqueSessionActionFilter : ActionFilterAttribute, IActionFilter
      {
          public long UsuarioId { get; set; }
  
          void IActionFilter.OnActionExecuting(ActionExecutingContext filterContext)
          {
              var contexto = new EntidadesContexto();
              // Recupero a Id do Usuário logado aqui.
              var idDoUsuario = UsuarioId;     
  
              var usuario = contexto.Usuarios.FirstOrDefault(u => u.UsuarioID == idDoUsuario && u.Logado && u.SessionID != filterContext.HttpContext.Session.SessionID);
  
              if (usuario != null)
              {
                  // Se o último login foi feito dentro do período de um dia
                  if (usuario.UltimoLogin.AddDays(1) > DateTime.Now)
                  {
                      // Usuário logado em outro lugar.
                      usuario.Logado = false;
                      contexto.Entry(usuario).State = EntityState.Modified;
                      contexto.SaveChanges();
                      // Destrua aqui a Session do Usuário se houver uma.                    
                  }
                  else
                  {
                      filterContext.HttpContext.Session.Abandon();
                      // O login do Usuário expirou.
                      var controller = (MeuControllerBase)filterContext.Controller;                    
                      filterContext.Result = controller.RedirectToAction("Index", "Autenticacao");                   
                  }
              }
          }
      }
  }
  

  Use:

  public class ControllerExemplo 
  {
  
      public long ExemploUsuarioId { get; set; }
  
      public ControllerExemplo() {
          ExemploUsuarioId = HttpContext.Current.Session["UsuarioID"]);
      }
  
      [FiltroSessao(UsuarioId = ExemploUsuarioId)]
      public ActionResult Index() { ... }
  }