5

In my web application, some users open app in multiple browser page. How can I catch users when they do it?

Edit about why I need such this thing: I have a variable named DealerID, carried between pages with session. Some users want that: "While I make my jobs with a DealerID in one page, make other jobs with another DealerID on another page"

I tried to explain. I hope, it will help.

18
  • 1
    Don't criminalize your users - opening multiple windows is not a crime!
    – Oded
    Dec 17, 2010 at 15:04
  • Catch them? And do what? I have SO open in two tabs now, should I be worried someone's coming for me? :/
    – Dave D
    Dec 17, 2010 at 15:04
  • 4
    To take a step back from the immediate issue: Why is it a problem when users open your app in two windows? Does it somehow corrupt the application state? Dec 17, 2010 at 15:05
  • A user opening yoru app in multiple browsers is essentially the same as multiple users opening it in single browser. Unless you want to track multiple sessions from the same IP (which is nowhere close to be reliable) you are without luck here
    – Andrey
    Dec 17, 2010 at 15:07
  • 5
    I'm not sure why everyone is so hung up on why. It's entirely possible that there is a specific business need for such behavior. Dec 17, 2010 at 15:09

5 Answers 5

3

The real thing you need to focus on is fixing your application to support multiple tabs/pages.

What I suggest you do is store the session data into the page of the application and reconstruct it when the page submits it back to the server. That way each page can use the same session variables to pass the page along, without it creating side effects in the system.

Session data really should be truly global data, that can be referenced without worry. If you have "long persisting" data that is created with the assumption that only one page will ever be using it, then you are going to have some trouble.

3

Session is the wrong thing to use for this use case. You should have the instance of the browser tell you what the DealerID is during each request. You can accomplish this with the query string, viewstate, with a dropdownlist/field on the page on the page, etc.

Rationale: Session is tied to all instances of the browser through a shared cookie, which causes this problem. Query String or ViewState, or a field on the page tie the data to a specific instance of browser window. By using this method, you're eliminating the problem completely and using the technology as it was designed.

1
  • I seriously feel like I'm taking crazy pills here. If the Session is causing you problem, don't use it. It's the easiest answer.
    – Greg
    Dec 18, 2010 at 20:11
2

Technically you cannot find out who has opened more than one page (HTTP is connection-less) unless they tell you themselves !

I'm thinking it as a matter of executive work (how to do it efficiently) rather than the best technical tamper-proof solution. So:

Put a little AJAX control (JavaScript code) on the page which works as a signaling component from a client and says Blah..Blah....

Use Session objects (ASP.NET would take care of correct session key/value for you, just use it at server side) and if there are two signals from a single client, you have catched(!) them as you wish. It's possible for a power user to disable this defense mechanism but you can raise the price by implementing it more complicated.

I suggest don't react to cheating immediately. Flag the user in your business logic and show the bill later. This is more effective i.e, what StackOverFlow.com do :)

1
  • Some users want that: "While I make my jobs with a DealerID in one page, make other jobs with another DealerID on another page" So the accepted answer is to not give the users the functionality they want?
    – Greg
    Dec 17, 2010 at 22:15
1

I would bind a token to the objects you are sending to the browser and store them in a database with reference to the user and the object they requested.

I would send the token with each request and embed it into a hidden field on the page. And then hook the token on any postback with javascript. If the token comes back more than once you have your extra tab!

1

Given that you want to count the number of tabs that a user has open with you application at the same time, the issues is that there really isn't a good way of doing it. The best way to do it would likely to be to run something locally, but since different browsers are coded differently, there isn't a good way to get the titles short of knowing which browser the user is using and making an API call to find out (if one is available!).

If you just need a basic, rough, estimate as to what the count might be. You could try setting a cookie when the application is loaded (loading it in a new tab would have to cause the cookie to be reset) and cross-referencing a GUID for each session with the IP address. However, this would never be quite accurate since multiple users could be on the same IP address, they could be using more than one browser, sessions could timeout, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.