Re: Session management when browser window is cloned
"Arvind" <asrinivasan@worldbank.org> wrote in message
news:1146007325.174021.50820@e56g2000cwe.googlegroups.com...
Oliver Wong wrote:
<mikharakiri_nospaum@yahoo.com> wrote in message
news:1145912511.982657.107620@v46g2000cwv.googlegroups.com...
How does the session object behaves when user clones browser window via
Ctrl-N? A simple test shows that the session stays the same. Is there a
way to identify a cloned window session programmatically?
Probably not.
Even though i right now dont recall 'how' it was done - but am sure
have seen it done in couple of j2ee applications...sorry not of much
help
Sessions are typically based on cookie or GET urls and
occasionally combined with IP addresses; i.e. data from the client. The
number one rule of web security is never trust data from the client.
As much as i agree with the 'security' implications of trusting the
data from a client - It could be a valid requirement simply to prevent
two browsers from operating on the same data, especially if it is an
edit form....
In the case of edit forms, what could be done is to generate a random
number, and place it in the form. Each time you get a submit, check if it
matches what you've got saved on the server side, and then change the random
number. If someone submits twice, you'll get the same number twice, and
you'll accept the first one, but reject the second one, since the second one
doesn't match the server side random number anymore.
I was thinking more along the lines of distinguishing between the user
"cloning" the window (as defined above), versus the user refreshing the
window via F5 for example.
- Oliver