User Experience Stack Exchange is a question and answer site for user experience researchers and experts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a secure site, is it OK to stop users from opening a link in a new tab by signing them out?

I have a mobile games web-app and my users can only play one at a time. To avoid issues of them trying to play multiple games at once I want to sign them out when they try to open it in a new tab.

I checked on a few social media and banking websites. Only 1 of my banking web sites cared about this and signed me out when trying to open a link in a new tab.


@fhlamarche set me on the right path and I pretty much did what @Martijn suggested in his comment.

When a user logs in, I set a GUID in their session and return it to the client. Each subsequent request from the client sends the GUID. If they open a new tab/window/browser the game logs in again and the GUID is updated. If the user tries to make an action in the original window with the old GUID, the server responds with an error message.

share|improve this question
How exactly are you checking to see that they're playing multiple games at once? Are you checking sessions? Rather than forcing the user to sign out why not just an error message saying something like "Are you sure you want to start X game? Your current game will be closed" - it's a lot less invasive/harsh in my opinion than forcing a sign out because then you force them to typein their credentials again and sign back in. – Anindya Basu Jul 18 '14 at 18:38
@AnindyaBasu I make an ajax call on page load that sends a query string parameter to the server to check if it has been used before. I agree an error message in the new window may be more appropriate – That-_-Guy__ Jul 18 '14 at 18:59
@That--Guy_ So, I open Firebug and set a breakpoint to modify it before it's sent... – Izkata Jul 19 '14 at 20:57
Take a look at, they have chat/badge system that only is connected on the tab with the the latest opened game. If you open a second game, you see a warning on the first game's tab and the option to reconnect (which will disconnect the second game). It doesn't prevent you from playing, but that could be implemented of course. – Kapep Jul 20 '14 at 10:56
up vote 61 down vote accepted

You're looking at the problem from the wrong angle. A user could also open a different browser, or use a second device, which means you can't rely on the idea of opening tabs(and preventing it), nor on IP address. Your solution needs to be server-side. Signing them out would just annoy them. Either make it so your website show them the same game no matter which browser/device/tab (hard solution), or simply prevent them from playing more than 1 game at a time (easy solution).

share|improve this answer
This is a neat answer. – Nicolas Barbulesco Jul 20 '14 at 13:37
To provide an very easy solution: When a user logs in, set a random string. Store that in the DB and in a session. If those don't match, the user has logged in somewhere else, so log this session out. – Martijn Jul 21 '14 at 7:16
Agreed. Just check serverside if they are already playing a game, and redirect them to an explanation page if they are. Or just let them play 2 games at once, why not? – superluminary Jul 21 '14 at 8:48

On any site is is not ideal to break a user's expectations.

As a user expects to be able to navigate the internet with tabs in their browser, you shouldn't break it.

share|improve this answer
related to this assertion:… – Toni Leigh Jul 20 '14 at 14:38

Google hangout has the same requirement as your application. You cannot do two hangouts at the same time.

Yet Google does not shock the user by disconnecting the first call when a second call is attempted. Instead, you see an error message in the second call's window.

Why don't you try the same approach?

share|improve this answer

You can make fake links in JavaScript. Example:

These fake links will only execute the JS code you assign to them, and there is no "Open in new tab" option possible. So if there are only your fake links on the page you have complete control over what they will do.

(You might also want to check the IP address to disallow someone from the same computer starting a new game from a different window, but you're going to have a hard time thwarting someone that really wants to play 2 games simultaneously.)

share|improve this answer
This is a band-aid: it only addresses someone clicking a link to open the web app, but what of copy-pasting the URL into another tab, or using a bookmark, or clicking a link not controlled by the web app? Also, don't ever check for unique sessions by IP address: then only one person behind a NAT will be able to use it, which is not the desired behaviour. – msanford Jul 18 '14 at 19:23
@obelia This url: – Justin Jul 19 '14 at 0:19
Sometimes you have to look deeper than the question and try to work out the intention, and in this case the intention is right there in the question: "To avoid issues of them trying to play multiple games at once". Preventing users opening another tab clearly isn't going to suffice. – Marjan Venema Jul 19 '14 at 8:20
This is one of those "clever" solutions like disabling copy-paste that does nothing to prevent abuse or mistakes but makes well-meaning people suffer. – Shog9 Jul 19 '14 at 16:56
This is possibly almost as annoying as disabling right click, and just as effective. My browser doesn't treat it as a link, it doesn't get styled consistently as a link, it's treated differently than a link for accessibility purposes, and it's just not a link. – Doorknob Jul 20 '14 at 10:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.