14

On a secure site, is it OK to stop users from opening a link in a new tab by signing them out?

I have a mobile games web-app and my users can only play one at a time. To avoid issues of them trying to play multiple games at once I want to sign them out when they try to open it in a new tab.

I checked on a few social media and banking websites. Only 1 of my banking web sites cared about this and signed me out when trying to open a link in a new tab.

Update

@fhlamarche set me on the right path and I pretty much did what @Martijn suggested in his comment.

When a user logs in, I set a GUID in their session and return it to the client. Each subsequent request from the client sends the GUID. If they open a new tab/window/browser the game logs in again and the GUID is updated. If the user tries to make an action in the original window with the old GUID, the server responds with an error message.

Improve this question
4
  • 31
    How exactly are you checking to see that they're playing multiple games at once? Are you checking sessions? Rather than forcing the user to sign out why not just an error message saying something like "Are you sure you want to start X game? Your current game will be closed" - it's a lot less invasive/harsh in my opinion than forcing a sign out because then you force them to typein their credentials again and sign back in.
    – Anindya Basu
    Jul 18, 2014 at 18:38
  • @AnindyaBasu I make an ajax call on page load that sends a query string parameter to the server to check if it has been used before. I agree an error message in the new window may be more appropriate
    – That-_-Guy__
    Jul 18, 2014 at 18:59
  • 6
    @That--Guy_ So, I open Firebug and set a breakpoint to modify it before it's sent...
    – Izkata
    Jul 19, 2014 at 20:57
  • 4
    Take a look at kongregate.com, they have chat/badge system that only is connected on the tab with the the latest opened game. If you open a second game, you see a warning on the first game's tab and the option to reconnect (which will disconnect the second game). It doesn't prevent you from playing, but that could be implemented of course.
    – kapex
    Jul 20, 2014 at 10:56

4 Answers 4

Reset to default
62

You're looking at the problem from the wrong angle. A user could also open a different browser, or use a second device, which means you can't rely on the idea of opening tabs(and preventing it), nor on IP address. Your solution needs to be server-side. Signing them out would just annoy them. Either make it so your website show them the same game no matter which browser/device/tab (hard solution), or simply prevent them from playing more than 1 game at a time (easy solution).

Improve this answer
3
  • This is a neat answer.
    – Nicolas Barbulesco
    Jul 20, 2014 at 13:37
  • 1
    To provide an very easy solution: When a user logs in, set a random string. Store that in the DB and in a session. If those don't match, the user has logged in somewhere else, so log this session out.
    – Martijn
    Jul 21, 2014 at 7:16
  • Agreed. Just check serverside if they are already playing a game, and redirect them to an explanation page if they are. Or just let them play 2 games at once, why not?
    – superluminary
    Jul 21, 2014 at 8:48
41

On any site, it is not ideal to break a user's expectations.

As a user expects to be able to navigate the internet using tabs in their browser, you shouldn't break it.

Improve this answer
1
13

Google hangout has the same requirement as your application. You cannot do two hangouts at the same time.

Yet Google does not shock the user by disconnecting the first call when a second call is attempted. Instead, you see an error message in the second call's window.

Why don't you try the same approach?

Improve this answer
-4

You can make fake links in JavaScript. Example: http://jsfiddle.net/Dkxj4/

These fake links will only execute the JS code you assign to them, and there is no "Open in new tab" option possible. So if there are only your fake links on the page you have complete control over what they will do.

(You might also want to check the IP address to disallow someone from the same computer starting a new game from a different window, but you're going to have a hard time thwarting someone that really wants to play 2 games simultaneously.)

Improve this answer
11
  • 13
    This is a band-aid: it only addresses someone clicking a link to open the web app, but what of copy-pasting the URL into another tab, or using a bookmark, or clicking a link not controlled by the web app? Also, don't ever check for unique sessions by IP address: then only one person behind a NAT will be able to use it, which is not the desired behaviour.
    – msanford
    Jul 18, 2014 at 19:23
  • 1
    @obelia This url: i.stack.imgur.com/6PeGa.png
    – Justin
    Jul 19, 2014 at 0:19
  • 5
    Sometimes you have to look deeper than the question and try to work out the intention, and in this case the intention is right there in the question: "To avoid issues of them trying to play multiple games at once". Preventing users opening another tab clearly isn't going to suffice.
    – Marjan Venema
    Jul 19, 2014 at 8:20
  • 18
    This is one of those "clever" solutions like disabling copy-paste that does nothing to prevent abuse or mistakes but makes well-meaning people suffer.
    – Shog9
    Jul 19, 2014 at 16:56
  • 1
    This is possibly almost as annoying as disabling right click, and just as effective. My browser doesn't treat it as a link, it doesn't get styled consistently as a link, it's treated differently than a link for accessibility purposes, and it's just not a link.
    – Doorknob
    Jul 20, 2014 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.