Advice on keeping track of users "Last Ip Address" - asp.net-mvc

Question

First of all, this is not a question about how to get the user's IP address, as i know how to do that.
Basically, administrators of my website (ASP.NET MVC 3 Web Application) need the ability to block a certain IP address from submitting user content. So i'm storing the "IP Address" against user in our system. Cool.
My question is:
When (e.g at what times, page lifecycle events) should i be checked the user's current IP address and saving to the database?
At the moment, i'm thinking of using session. That is, when i first create the session (e.g Session_OnStart()), grab the users IP address and stick it in the session. Then when the session ends (e.g Session_OnEnd()), i see if the IP address in session is different to that of the database. If it is, update the DB.
At the moment we're using InProc, but there's a good chance we'll go to StateServer later on - and MSDN states Session_OnEnd is only available to InProc. So that might be a problem.
Any thoughts/alternatives to this approach?
EDIT
So i tried using Session_OnStart() to try and do the following thing:
If user is authenticated, get their IP address, get their last IP from the database, and if they different, update the database.
But the problem seems to be that Session_OnStart runs before Application_AuthenticateRequest - so it's never passing the "is authenticated" check.
A good example is if a user logs into my website - using Forms Auth, which sets a cookie with an expiration date of a week (for example).
Then they come back a few days later - the Session_OnStart is fired - but they're not authenticated yet. Even though the cookie is present - it hasn't been processed into the http context yet.
So the Session_OnStart looks like a no go - any other ideas?

Answer 1

Would there be a problem in just logging the ip at the start of the session rather than the end? Like you say, the ip wont change during a session.

Answer 2

Have accepted #lomaxx's answer - but thought i'd add my own for others and the reasoning as to why this is required.
Solution: Global action filter executing on every request.
(Simplified) code:
public class UserTrackingFilterAttribute : ActionFilterAttribute
{
public override void OnResultExecuted(ResultExecutedContext filterContext)
{
// If the user isn't authenticated or we have already tracked IP this session, bubble back up to base context.
if (!Authenticated || HaveTrackedIpAddressThisSession)
{
base.OnResultExecuted(filterContext);
return;
}
// Get the users current ip address.
var currentIp = HttpContext.Current.Request.CurrentIpAddress(); // extension method to read server variables, cater for proxy, etc
// Get the users last known ip address from repository.
var userService = ObjectFactory.GetInstance(typeof(IUserService)) as IUserService;
var unitOfWork = ObjectFactory.GetInstance(typeof(IUnitOfWork)) as IUnitOfWork;
if (userService == null || unitOfWork == null) return;
// See if the user's ip has changed.
var currentUser = userService.FindById(CurrentUserId);
if (currentUser == null || (currentUser.LastIpAddress != null && IPAddress.Parse(currentUser.LastIpAddress).Equals(currentIp)))
{
// User cannot be found or IP hasn't changed - set session key and bubble back up to base context.
HaveTrackedIpAddressThisSession = true;
base.OnResultExecuted(filterContext);
return;
}
// User's ip has changed - update ip address.
currentUser.LastIpAddress = currentIp.ToString();
// Save.
userService.Save(currentUser);
// Commit.
unitOfWork.Commit();
// Update session key.
HaveTrackedIpAddressThisSession = true;
}
}
"CurrentUserId" and "HaveTrackedIpAddressThisSession" are private properties to shorten code in that method. Basically they read HttpContext.Current.User.Identity and HttpContext.Current.Session["someKey"] respectively.
Why i need a global action filter over a Global.asax event: because my logic requires a Http principal be present, i can't use Session_OnStart since at that time, the forms authentication cookie has not been decrypted into the principal identity. So although this runs on every page request, the session "flag" mitigates this overhead.

Answer 3

Since it's asp.net MVC and you want it to run against all request, I'd consider looking at using a global action filter like the one described here http://weblogs.asp.net/gunnarpeipman/archive/2010/08/15/asp-net-mvc-3-global-action-filters.aspx

Answer 4

I'm taking a guess you are doing the comparison in the database, reading your question.
My suggestion is keeping the blocklist in web.config for simplicity and compare the incoming id to it whenever you need.
If you need to keep the blocklist in the database I'd say use the caching class to cache the blocklist for a reasonable amount of time and compare the ip to the blocklist in your code instead of in the database.