Running a Web Site in Kiosk Mode with C#

Introduction

This article addresses a simple approach to supporting the display of a website in kiosk mode using a simple Win Forms application. Kiosk mode is used to display the contents of a web page without the browser controls visible. The notion for doing something like that is that one can use a website to display some specific information to a user without allowing the user to navigate away from the website. For example, if one needed to display a building map in the lobby of a business or allow a user to investigate a product line and place a sales order from a mall display, a kiosk might be just the ticket.

Naturally, as with anything, there are problems with keeping a user locked onto a page or set of pages on the site. Most of these are easily handled, but the design of the site has to be carefully considered in advance (for example, one would not want to display advertisements that would allow the user to link off to a different website). Of course, if the user has a keyboard, it might be a good idea to disable certain hotkey combinations to prevent the user from opening a new browser window or closing the current browser window. One may even need to violate the default security policy on the machine to prevent the user from opening the task manager or start menu. This example addresses disabling hotkey combinations that don't violate SAS; however, if it is necessary, one can investigate making registry changes or other alternative methods for disabling CTRL+ALT+DEL and CTRL+ESC, including third-party controls or the MSGina.DLL (which I understand to no longer work with Vista).

A better answer might be to investigate the use of a touch interface, a touch interface virtual keyboard, or a kiosk keyboard that will not permit a user to input such key combinations; the easiest way to keep a user from messing around with the operating system and other applications on the machine is, of course, be to remove the standard keyboard from the equation.

An alternative to kiosk mode websites would be to use full-screen win forms applications; the same issues still apply in terms of CTRL+ALT+DEL and CTRL+ESC, but they can be managed differently; for example, one could use key previews to block certain key combinations from going through.

demonstrationapplication running

Figure 1. The demonstration application running

Website in Kiosk Mode

Figure 2. Displaying a Website in Kiosk Mode

Getting Started

In order to get started, unzip the included project and open the solution in the Visual Studio 2008 environment. In the solution explorer, you should note these files (Figure 3).

Solution Explorer

Figure 3. Solution Explorer

The Main Form (frmKioskStarter.cs)

The main form is the only form contained in the application; all of the application-specific code required to display the website in kiosk mode is contained in this form, as is all of the code used to block certain hotkey combinations. The code shows how to shut down many of the browser-related hotkey combinations but does not do anything to violate the default security policies of the machine.

The code is pretty simple. If you'd care to open the code view up in the IDE, you will see that the code file begins as follows.

using System;
using System.Collections;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using System.Runtime.InteropServices;

The imports are per the default configuration for a Windows application; some unnecessary libraries were omitted, generics were dropped from the collection's reference, and Interop services were added to the list.

Following the imports, the namespace and class are defined.

namespace KioskMode
{
    public partial class frmKioskStarter : Form
    {
        // Your class members and methods go here
    }
}

Following the class declarations, a region is defined, and the DLL imports needed to alter the global hotkeys and disable the status bar are included.

#region Dynamic Link Library Imports
[DllImport("user32.dll")]
private static extern int FindWindow(string cls, string wndwText);
[DllImport("user32.dll")]
private static extern int ShowWindow(int hwnd, int cmd);
[DllImport("user32.dll")]
private static extern long SHAppBarMessage(long dword, int cmd);
[DllImport("user32.dll")]
private static extern int RegisterHotKey(IntPtr hwnd, int id, int fsModifiers, int vk);
[DllImport("user32.dll")]
private static extern int UnregisterHotKey(IntPtr hwnd, int id);
#endregion

Following the DLL imports, another region is defined and used to contain the modifier key constants and to declare a hot key Id variable; each hot key combination disabled by the application is assigned an ID number (a short) which is also used to remove the hot key restrictions whenever the application is stopped.

#region Modifier Constants and Variables
// Constants for modifier keys
private const int USE_ALT = 1;
private const int USE_CTRL = 2;
private const int USE_SHIFT = 4;
private const int USE_WIN = 8;
// Hot key ID tracker
short mHotKeyId = 0;
#endregion

Within the constructor, a series of hotkey combinations are disabled to make it a little more difficult to navigate away from the kiosk site.

public frmKioskStarter()
{
    InitializeComponent();

    // Related browser window key combinations
    // -- Some things that you may want to disable --
    // CTRL+A       Select all
    // CTRL+B       Organize favorites
    // CTRL+C       Copy
    // CTRL+F       Find
    // CTRL+H       View history
    // CTRL+L       Open locate
    // CTRL+N       Open new browser window
    // CTRL+O       Open locate
    // CTRL+P       Print
    // CTRL+R       Refresh
    // CTRL+S       Save
    // CTRL+V       Paste
    // CTRL+W       Close
    // CTRL+X       Cut
    // ALT+F4       Close
    // Use CTRL+ALT+DEL to open the task manager,
    // kill IE and then close the application window
    // to exit
    // Disable ALT+F4 - exit
    RegisterGlobalHotKey(Keys.F4, USE_ALT);
    // Disable CTRL+W - exit
    RegisterGlobalHotKey(Keys.W, USE_CTRL);
    // Disable CTRL+N - new window
    RegisterGlobalHotKey(Keys.N, USE_CTRL);
    // Disable CTRL+S - save
    RegisterGlobalHotKey(Keys.S, USE_CTRL);
    // Disable CTRL+A - select all
    RegisterGlobalHotKey(Keys.A, USE_CTRL);
    // Disable CTRL+C - copy
    RegisterGlobalHotKey(Keys.C, USE_CTRL);
    // Disable CTRL+X - cut
    RegisterGlobalHotKey(Keys.X, USE_CTRL);
    // Disable CTRL+V - paste
    RegisterGlobalHotKey(Keys.V, USE_CTRL);
    // Disable CTRL+B - organize favorites
    RegisterGlobalHotKey(Keys.B, USE_CTRL);
    // Disable CTRL+F - find
    RegisterGlobalHotKey(Keys.F, USE_CTRL);
    // Disable CTRL+H - view history
    RegisterGlobalHotKey(Keys.H, USE_CTRL);
    // Disable ALT+Tab - tab through open applications
    RegisterGlobalHotKey(Keys.Tab, USE_ALT);
    // hide the task bar - not a big deal, they can
    // still CTRL+ESC to get the start menu; for that
    // matter, CTRL+ALT+DEL also works; if you need to
    // disable that, you will have to violate SAS and
    // monkey with the security policies on the machine
    ShowWindow(FindWindow("Shell_TrayWnd", null), 0);
}

The next button click event handler is used to launch the browser window in kiosk mode; passing the 'k' argument to Internet Explorer is all that is required. The URL entered into the form's textbox is used to identify what page will be opened into IE.

/// <summary>
/// Launch the browser window in kiosk mode
/// using the URL keyed into the text box
/// </summary>
/// <param name="sender"></param>
/// <param name="e"></param>
private void button1_Click(object sender, EventArgs e)
{
    // Start the Internet Explorer process with the -k flag
    // to run it in kiosk mode, and pass the URL from the text box as an argument.
    System.Diagnostics.Process.Start("iexplore", "-k " + txtUrl.Text);
}

The next bit of code is used to register a hot key combination; in this instance, we are using it to override an existing hot key combination.

private void RegisterGlobalHotKey(Keys hotkey, int modifiers)
{
    try
    {
        // Increment the hot key value - we are just identifying
        // them with a sequential number since we have multiples
        mHotKeyId++;
        if (mHotKeyId > 0)
        {
            // Register the hot key combination
            if (RegisterHotKey(this.Handle, mHotKeyId, modifiers,
                Convert.ToInt16(hotkey)) == 0)
            {
                // Tell the user which combination failed to register
                // This is useful for debugging purposes, not for end users
                // The user should never see this application run
                MessageBox.Show("Error: " + mHotKeyId.ToString() + " - " + Marshal.GetLastWin32Error().ToString(), "HotKey Registration");
            }
        }
    }
    catch
    {
        // Clean up if hotkey registration failed -
        // Nothing works if it fails
        UnregisterGlobalHotKey();
    }
}

The next method is used to unregister the hotkeys set up by the application; this is used to restore normal functioning after the application is closed. The combinations are identified by the hot key ID value stored for each replaced by the application; to disable all of them this bit of code loops through each ID and disables it.

private void UnregisterGlobalHotKey()
{
    // Loop through each hotkey id and disable it
    for (int i = 0; i < mHotKeyId; i++)
    {
        UnregisterHotKey(this.Handle, i);
    }
}

The next bit of code is used to handle the receipt of a hotkey combination whenever the application is running. The code merely disregards all registered hotkey combinations.

protected override void WndProc(ref Message m)
{
    base.WndProc(ref m);
    // If the message matches, disregard it
    const int WM_HOTKEY = 0x312;
    if (m.Msg == WM_HOTKEY)
    {
        // Ignore the request for each disabled hotkey combination
    }
}

The last bit of code is called when the form closes; this code unregisters all of the hotkey combinations and shows the taskbar once again.

private void Form1_FormClosed(object sender, FormClosedEventArgs e)
{
    // Unregister the hot keys
    UnregisterGlobalHotKey();
    // Show the taskbar - does not matter really
    ShowWindow(FindWindow("Shell_TrayWnd", null), 1);
}

Summary

Even though this application shows how to display a website in kiosk mode and to disable browser-related hot keys, the application does not violate the security policy. In building a kiosk, it would be best if the user did not have access to a full keyboard or any keyboard at all. If alphanumeric input is required, consideration of the use of custom kiosk keyboards or a virtual keyboard should be considered.