What is the proper way of handling multiple account login from the same machine & browser?

Question

I'm wondering if anyone knows how exactly Gmail, Hotmail, Facebook etc handles following scenario. (NOTE: Assuming Cookie is shared between tabs)

1. Opens two login page to the application.
2. User 1 logs in the domain.
3. User 1 changes some data without saving it.
4. User 2 logs in the domain in a separate tab.
5. User 1 switches back to his tab and saves the data.

I tried repeating the steps FF for Gmail, it sometimes gives me "This may have happened automatically because another user signed in from the same browser" and logs the previous user out automatically" but the other times just shows "The page isn't redirecting properly" and I'll have to clear my cookie.

Hotmail, seems to be a bit better, where it immediately detects that I'm logged in the first page and asking if I would like to switch account. If I selected to switch account and goes back to try to save the data, hotmail throws a login error message.

Anyone can shed some light on how each one is implemented as well as what might be the best practice to handle this problem?

Answer 1

In general, to counteract such issues you'll want to do cross-references of the identity from cookie and other submitted data. So the submitted form will include the user id, and the cookie will include the user session. If those are inconsistent, then reject the attempt, invalidate the session, and send the user to login.

If your forms have CSRF protection tokens (which they should), then the CSRF token can also encode the user ID, so the attempt for user 1 to save their data will fail due to an invalid CSRF token on the form.