Trigger confirmation message box during asp.net LoggingIn event - asp.net

Question

I have a web application in vb in which I am using this approach to prevent a user from having concurrent logins due to a simple licensing agreement.
It works great, if a user logs in with an account that is already in use, the first user gets logged out. I am trying to add a messagebox or some kind of js confirmation box in the loggingin event that states:
This user account has been active in the last 20 minutes.
If someone else is using it, then logging in may possibly
compromise any report generation or activity.
Continue login?
Here is the code:
<asp:Login ID="Login1" runat="server" DestinationPageUrl="~/Dashboard/Default.aspx" >
<LayoutTemplate>
<table border="0" cellpadding="0">
<tr>
<td align="right"><p><asp:Label ID="UserNameLabel" runat="server" AssociatedControlID="UserName">User Name:</asp:Label></p></td>
<td align="right">
<p><asp:TextBox ID="UserName" runat="server" Width="220" autocomplete="on" />
<asp:RequiredFieldValidator ID="UserNameRequired" runat="server" ControlToValidate="UserName" Text="*"
ErrorMessage="User Name is required." ToolTip="User Name is required." ValidationGroup="Login1" /></p>
</td>
</tr>
<tr>
<td align="right"><p><asp:Label ID="PasswordLabel" runat="server" AssociatedControlID="Password">Password:</asp:Label></p></td>
<td align="right">
<p><asp:TextBox ID="Password" runat="server" TextMode="Password" Width="220"></asp:TextBox>
<asp:RequiredFieldValidator ID="PasswordRequired" runat="server" ControlToValidate="Password" Text="*"
ErrorMessage="Password is required." ToolTip="Password is required." ValidationGroup="Login1" /></p>
</td>
</tr>
<tr>
<td align="center" colspan="2" style="color: red"><asp:Literal ID="FailureText" runat="server" EnableViewState="False"></asp:Literal></td>
</tr>
<tr>
<td align="right" colspan="2"><asp:LinkButton CssClass="prettyButton" ID="LoginButton" runat="server" CommandName="Login" Text="Log In" ValidationGroup="Login1" /></td>
</tr>
</table>
</LayoutTemplate>
</asp:Login>
Private Sub Login1_LoggingIn(sender As Object, e As LoginCancelEventArgs) Handles Login1.LoggingIn
Dim messagetext As String = "This user account has been active in the last 20 minutes." + Environment.NewLine + Environment.NewLine
messagetext += "If someone else is using it, then logging in may possibly" + Environment.NewLine
messagetext += "compromise any report generation or activity." + Environment.NewLine + Environment.NewLine
messagetext += "Continue login?"
Dim userNameTextBox As System.Web.UI.WebControls.TextBox = DirectCast(Login1.FindControl("UserName"), System.Web.UI.WebControls.TextBox)
Dim currentUser As MembershipUser = Membership.GetUser(userNameTextBox.Text)
If currentUser IsNot Nothing Then
If currentUser.IsOnline Then
'*****CONFIRMATION MESSAGE BOX TO GO HERE*****/
Dim result = MessageBox.Show(messagetext , "Login Warning", MessageBoxButtons.YesNo)
'* IF USER DECIDES NOT TO LOGIN:*/
If result = DialogResult.No Then
e.Cancel = True
End If
'* ELSE LOGIN CONTINUES AND ORIGINAL USER IS LOGGED OUT*/
End If
End If
End Sub
Private Sub Login1_LoggedIn(sender As Object, e As EventArgs) Handles Login1.LoggedIn
Dim userNameTextBox As System.Web.UI.WebControls.TextBox = DirectCast(Login1.FindControl("UserName"), System.Web.UI.WebControls.TextBox)
SingleSessionPreparation.CreateAndStoreSessionToken(userNameTextBox.Text)
End Sub
Now, I can use a windows form msgbox() locally, and everything works great, but once I put it on a server, the message box obviously doesn't work. I've tried ClientScript and ScriptManager, but the client side check doesn't seem to get triggered.
Any help is greatly appreciated.

Answer 1

Do not use the VB MessageBox in a web site. It will ONLY show up on the server - and will more than likely kill your page every time. The end user will never see it on his browser.
There are a bunch of ways you could handle what you're trying to achieve, though one that will work well is to show the user a javascript confirm box; which is more or less the same as a message box but has an OK and Cancel button instead.
You can show this to the user by injecting a little javascript to your page as it renders. So, remove your Dim result.... line and replace it with something like this: - this will inject some javascript to your pages HTML.
Dim cs As ClientScriptManager = Page.ClientScript
cs.RegisterStartupScript(Me.GetType(), "userChecker", "UserCheck(Confirm('yourMessage'));", True)
NOTE - you will also remove the code that checks your dialog, I.E If result = ....
When the page loads the confirm dialog will appear. The captured response, in this case, will be passed to a javascript function called UserCheck - so have a javascript function in your HTML to accept it. Something like this:
function UserCheck(t){
if (t){
// do something for OK
}else{
// do something for CANCEL
}
Within the UserCheck you can easily handle the users response. Perhaps by redirecting, or causing a postback by calling the __doPostBack function of .Net.