We are getting hits from random IP addresses around the world, a few times a week. They ping the page and then never proceed further, never log in (they wouldn't be able to without an account). We get half-a-dozen hits within a few seconds, using up half-a-dozen licenses - we only have 14, and several more are used anyhow by the system. Those session persist for twenty minutes because of the Grace period for our CSP pages. When that happens, it is very likely that some of our own users will be unable to log in because all the licenses are gone.

We try to stop them at the firewall, but it's new IP addresses every time, and anyone can go to our website.

So what I wanted to do was check the license logging every minute, see which sessions are from IPs that never tried to log in, say after a minute, and get rid of them. That way we get the license(s) back. I have working code that identifies those sessions.

If I were coming from a CSP page itself, I would do something like

%session.EndSession=1
%session.Data
%session.Logout()
But that won't work from an outside job: I need to be able to access the right session. That's all I'm trying to do: get access to the correct %CSP.Session object.

Sorry, could you explain what you mean by this? If you mean, when would we want to end a session, the answer is that we have been getting a lot of CSP sessions created by pings on the web page from the outside. Someone from who-knows-where calls the web page, a session is created and it uses a license until the grace period expires 20 minutes later. If half-a-dozen of them happen at once (which has been happening), we're out of licenses.

So we were trying to look over the license usage each minute, check each of the licenses associated with a CSP type, and end the session if that user never actually logged in.