Ways to detect CTRL-N or when a user opens a new window

Question

How can we detect when a user opens a new window. The user is already authenticated and we make heavy use of sessions.

We were trying to avoid ctrl-n javascript hooks but maybe that is an option.

I am assuming the request is the exact same URL...with CTRL-n?

Answer 1

Why?

And anyway you can't detect it. User can open new window not only with ctrl+n but also with File->New Window.

Answer 2

Yes and no,

You'll always see it if a control have focus, else the event is sent directly to the browser and the code on the page never hear about it.

In my experience you can't hijack the browsers shortcut, your mileage may vary. You are likely to know it happened but the browser will do its thing (for obvious reason)

In most browser the effect of Ctrl+N is to open a new window at the same URL as the old one and associate it with the same sessionID.

Your best bet would be to modify the back end code if possible and allow for such things. Breaking the browser's feature is never a good thing.

Answer 3

We were trying to avoid ctrl-n javascript hooks

Forget it. Whilst you could in theory try to catch keypress events for ‘n’ with the Control key modifier, there are any number of other ways to open a new window or tab which may be more likely to be used, and you won't be able to catch. File->New Window/Tab, middle click or shift-click link, middle click back/forward buttons, right-click-open-in-new-window, open bookmark in new tab, double-click browser icon...

The user is already authenticated and we make heavy use of sessions.

That shouldn't be a problem in itself. I guess what you mean is that your application is dumping all sorts of page-specific data in the session that it shouldn't have, and now you find the application breaks when you have more than one window open on it? Well, commiserations and happy rewriting.

In the meantime about all you can do is tell the user “please don't try to open two browser windows on the same application”. There are potential ways you can make JavaScript on one page notice that JavaScript is running on another page in the same domain at the same time, generally involving using document.cookie as a inter-page communications conduit. But that's also a bit fragile.

Answer 4

If opening a new window causes a problem in your application, then you should fix the application code to handle it instead of trying to apply an inconsistent and unreliable client-side "bandage". That's my opinion.

Answer 5

You could possibly put a window count into the session and increment it on window.onload and decrement it on window.onunload.

Imagine me tutting, sucking air through my teeth and going "better you than me, guvna" if you use that, though.

Answer 6

What I have done to solve this issue is when the user authenticates set the window name on valid login.

<script>

window.name = 'oneWindow';

</script>

And then on the master page do a javascript check:

<script>

if (window.history.length == 0 || window.name != 'oneWindow') 

//history length to see if it's a new tab or opened in a new window  0 for IE, 1 for FF

//window name to see if it's a CTRL + N new window

</script>

If the check is true then hide/remove the main content of the page and show a message stating they are doing something unsupported.

This works when your login page is not tied into the master page.

If you do not have a master page then I would suggest putting the check on all your pages.