Member Avatar for khan43

Hi

I am trying to edit security into my website which I have created in visual studios 2008 using asp.net. If I copy the URL into a new tab within internet explorer, it does not seem to log me out. I would like it to log me out due to secuirty reasons, can anybody offer help & advice?


Thank you

  • 2 Contributors
  • 2 Replies
  • 123 Views
  • 21 Hours Discussion Span
  • Latest Post Latest Post by khan43

Dani AI

Generated

Building on 's hint, a reliable way to force a logout when someone pastes your site URL into a new tab is to treat each browser tab as a separate client and require a per‑tab token on every protected request. That token must be created and stored in the tab (client side) and remembered by the server for the logged‑in session. On a new tab the token will be missing, so the server can sign the user out or redirect to login.

Typical workflow (where to put code)

  • On the login page (login.aspx) include a hidden tabId field. JavaScript sets a per‑tab token from sessionStorage (fallback to window.name for very old browsers) before submit.
  • On successful login, store the submitted tabId in server session state (for example Session["AllowedTabId"]).
  • On every protected page put a single server check (base Page class OnInit or an HttpModule in AcquireRequestState) that compares the incoming tabId (form field or custom header) to the session value. If missing or different, sign out and redirect to the login page.

Example client snippet (add to pages including the login form):

if (window.sessionStorage) {
  if (!sessionStorage.tabId) sessionStorage.tabId = Math.random().toString(36).slice(2);
  var token = sessionStorage.tabId;
} else {
  if (!window.name || window.name.indexOf('tab-')!==0) window.name = 'tab-' + Math.random().toString(36).slice(2);
  var token = window.name;
}
var forms = document.getElementsByTagName('form');
for (var i=0;i<forms.length;i++) {
  var f = forms[i];
  var inp = f.querySelector ? f.querySelector('input[name="tabId"]') : null;
  if (!inp) { inp = document.createElement('input'); inp.type='hidden'; inp.name='tabId'; f.appendChild(inp); }
  inp.value = token;
}

Minimal server check idea (place in a common base Page):

protected override void OnInit(EventArgs e) {
  base.OnInit(e);
  var incoming = Request.Form["tabId"] ?? Request.Headers["X-Tab-Id"];
  var allowed = Session["AllowedTabId"] as string;
  if (allowed == null) Session["AllowedTabId"] = incoming;
  else if (string.IsNullOrEmpty(incoming) || !allowed.Equals(incoming)) {
    FormsAuthentication.SignOut();
    Response.Redirect("~/Login.aspx");
  }
}

Notes and cautions

  • Add the token to AJAX requests (custom header). For jQuery use beforeSend to set X-Tab-Id.
  • Use HTTPS and usual session protections; this is an extra layer, not a replacement for secure session management. See browser support for sessionStorage (for reference) and OWASP session recommendations.
  • Usability: legitimate multi‑tab workflows will be blocked by this approach. Consider UX tradeoffs before enforcing it site‑wide.

Recommended Answers

All 2 Replies

Member Avatar for kvprajapati

Putting the URL in a new window/tab will issue a GET (method) to the server. So, you can write some sort of code which compare cookies and method type.

Member Avatar for khan43

Could you show me example of the code? And where should place this code, in the login.aspx?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.