How to prevent user from opening the application in multiple browser tabs?

Question

We are looking for a way to prevent users from opening the application in multiple tabs under the same browser.

The idea is to get plugged into one of the query Filter and then get access to the session maybe, and check if there is an already opened tab before proceeding.

I looked into httpSession and HttpRequest stuff but found nothing that can help.

Is there any functionality in the java side to know if the app is already opened in another tab?

thanks,

Answer 1

There's ways to accomplish this with Javascript.

See past questions / answers

• How to prevent same website open multiple tab pages?
• Stop people having my website loaded on multiple tabs
• Preventing user from opening multiple tabs for the application

But all of those javascript techniques fail to work if ...

• your user simply turns off Javascript.
• they load the website from multiple browsers.
• they load the website from normal and incognito modes on the same browser.
• they load the website from multiple devices (laptop and cell phone).

You'll wind up with a mix of feature to attempt to prevent this (but it's a losing battle, and there's countless ways to get around it).

If you have a login, you'll want to track past logins and offer to disconnect / invalidate those other logins on a new login. (this will help with the multiple browsers and devices attempts). Your authorization layer on your server side will invalidate old sessions if they are attempted to be used.

If you have multiple tabs in the same browser, the javascript techniques from the old questions/answers are probably the best.

There are also people attempting to use websocket to act as the single point of communication, but I don't understand how that could work, but you'll come across it in your research.

Answer 2

From the server's perspective, it doesn't matter if the requests come from the same browser tab, different tabs, different browsers or different devices. Two tabs can share the same session. There is no way for the server (or the servlet) to know whether the request came from tab A or tab B. Tabs are a browser feature, it doesn't get sent in the HTTP header.

If you would elaborate on why you want to do this, I might be able to give a better answer.