Re^2: multiple browserwindows session bug

The real problem with this behaviour is when you register several accounts on the same computer and there are activation emails sent to new members. When you click the link in the activation email you get to my community page and instead of activating the account, you are logged in as another just created user.

This is not likely to happen to an everyday member of my site, but it happens to me while testing and to the site owners when they preregister members.

Comment on Re^2: multiple browserwindows session bug

Replies are listed 'Best First'.
Re^3: multiple browserwindows session bug by Joost (Canon) on Jun 11, 2006 at 23:13 UTC
Can't you just log out the current session's user if the activation url is requested? As far as I can see that would solve the problem. "What should it profit a man, if he should win a flame war, yet lose his cool?"	[reply]
Re^4: multiple browserwindows session bug by boboson (Monk) on Jun 11, 2006 at 23:34 UTC
I explain the problem a little bit further in this node: 538997 Maybe I could do as you suggested and delete the session when the member clicks the activation link in the mail.	[reply]
Re^3: multiple browserwindows session bug by perrin (Chancellor) on Jun 12, 2006 at 04:55 UTC
Do you understand that this only happens with multiple windows of the same running browser? If different users each log in to the computer and run a browser, they are not sharing the same one. If a user logs in and never logs out, and someone else shares that same account on the same computer, then of course the session on your site will remain in effect. All that you do about that is use a short inactivity period on your sessions.	[reply]
Re^4: multiple browserwindows session bug by boboson (Monk) on Jun 12, 2006 at 12:38 UTC
I don't know if there is a difference with open up new browser windows or open up a new browser window from an already open browser? My problem occurs when I open up new browser windows. I thought that the session would expire if the user would close the browser? Is there a way to force this behaviour?	[reply]
Re^5: multiple browserwindows session bug by Joost (Canon) on Jun 12, 2006 at 12:46 UTC
Depends on your browser. Under windows & most unixes (except mac osx), closing all browser windows will stop the browser process, and should delete all session cookies. Under Mac OS-X this doesn't work, and you should use the "Quit" menu item. That method will probably work for all browsers everywhere. Note that this only works for real session cookies, i.e. cookies that have no expiry date. Cookies with an expiry date are held untill they expire or invalidated by the server. update: for the real details, see RFC 2109 "What should it profit a man, if he should win a flame war, yet lose his cool?"	[reply]