On a secure site, is it OK to stop users from opening a link in a new tab by signing them out?
I have a mobile games web-app and my users can only play one at a time. To avoid issues of them trying to play multiple games at once I want to sign them out when they try to open it in a new tab.
I checked on a few social media and banking websites. Only 1 of my banking web sites cared about this and signed me out when trying to open a link in a new tab.
@fhlamarche set me on the right path and I pretty much did what @Martijn suggested in his comment.
When a user logs in, I set a GUID in their session and return it to the client. Each subsequent request from the client sends the GUID. If they open a new tab/window/browser the game logs in again and the GUID is updated. If the user tries to make an action in the original window with the old GUID, the server responds with an error message.
ajaxcall on page load that sends a query string parameter to the server to check if it has been used before. I agree an error message in the new window may be more appropriate