C# How Restrict the user from opening a link in new tab

Hi,

Each time we open a new IE browser a new session gets started even if the same user has logged in. The session_start event gets fired for opening the browser each time.

So either you have to invalidate the previuos session or you have to store data in such a way that it doesn't get lost.

In Chrome you can use private browsing to achieve the same.

Chrome - Wrench(tools) menu/open new window without history

In Firefox you can use IE tab extension, and have another tab rendered with an IE engine to achieve the same effect.

You might find the following link as useful

http://www.computer-realm.net/managing-multiple-gmail-accounts-with-firefox/

Stopping short cut Ctrl + N + Click in browser will require Java script to work on, but my suggestion is to handle it in a code such a way that for each session the userdata for the same user can be maintained properly.

Access to ASP.NET session state is exclusive per session, which means that if two different users make concurrent requests, access to each separate session is granted concurrently. However, if two concurrent requests are made for the same session (by using the same SessionID value), the first request gets exclusive access to the session information. The second request executes only after the first request is finished. (The second session can also get access if the exclusive lock on the information is freed because the first request exceeds the lock time-out.) If the EnableSessionState value in the @ Page directive is set to ReadOnly, a request for the read-only session information does not result in an exclusive lock on the session data. However, read-only requests for session data might still have to wait for a lock set by a read-write request for session data to clear.

In ASP.NET MVC to forbid authenticated users to open multiple tabs:

 language="javascript" type="text/javascript">     @if(Request.IsAuthenticated)     {         <text>         if (window.name != 'singleWindow') {             window.location.href = "Content/ErrorPages/SingleTab.htm";         }          </text>     }     else     {                  window.name = "singleWindow";         text>     } 

Basically, this sets the window name first time when the user visits the login page. After logging in, for each subsequent page load the window name is tested.

I am unsure why you wish to restrict a session to handle only one inspection process, and then force multiple sessions in order for users to work simultaneously on multiple inspections. That feels like a rather awkward style of isolation.

The web application (and pages) ought to be able to handle multiple inspection processes within a single user session.

Whatever data that is being held in Session variables should not be plainly exposed for singular handling. They ought to be stored in collections that readily identify which set of data belongs to which inspection process. Every page submission back to the web server ought to carry an identifier which inspection process it pertains to, so that the correct session set can be matched and pulled for use.

pseudo code concept

var inspectionID = this.inspectionLabel.Text;
var inspectionSets = (Hashtable)Session["inspections"];
var inspection = (Inspection)inspectionSets[inspectionID];

Another Approach

Create a hidden field with a page ID and include that when you are trying to access whatever object in session Assign a random guid or value to that hidden control and then use it to store stuff in session

ex.

Session(PageID.Value & "CheckBoxes") = D

Another thought

 mode="InProc" cookieless="UseUri" />

Whatever session method you're using, it will still be possible to get the same session into multiple tabs, and impossible to detect on the serverside that a page has been opened in a new tab.

Regardless of whether you're allowed to use it or not, the UseUri session management method won't help. If a user tries to open a link in a new tab rather than in the current window, you [a] have no way of detecting this on the server-side, and [b] you have no way on the server-side to create a new session, transfer the page execution to this new session, all whilst keeping the current session intact.

Another thought

To facilitate multi-tab session states for one user without cluttering up the URL, do the following.

Include this somewhere inside your form tag:

 ID="PageID" runat="server" />

In your form load function, include:

If Not IsPostback Then   'Generate a new PageiD'   PageID.Value = (New Random()).Next() End If

When you save something to your Session State, include the PageID:

Session(PageID.Value & "CheckBoxes") = D

Notes:

• As with session ID's in general, you cannot trust that malicious viewers will not change the SessionID / PageID. This is only a valid solution for an environment where all users can be trusted.
• You will not have access to the PageID until the ViewState is restored upon PostBack. Therefore, you will not have access to the PageID in the page_init() handler.

Another Approach

         cookieless="true"       regenerateExpiredSessionId="true" />    

in this case each tab will get unique ID and it will looks like it is another visitor.

To get a clearer concept please go through the following link

http://msdn.microsoft.com/en-us/library/ms178581.aspx

If you find this post as useful please mark it an answer.

Thanks,

Upamanyu