从同一台计算机处理多个帐户登录的正确方法是什么？浏览器？
我想知道是否有人知道 Gmail、Hotmail、Facebook 等究竟如何处理以下情况。 （注意：假设 Cookie 在选项卡之间共享）
- 打开应用程序的两个登录页面。
- 用户1登录域。
- 用户 1 更改了一些数据但未保存。
- 用户 2 在单独的选项卡中登录域。
- 用户 1 切换回其选项卡并保存数据。
我尝试对 Gmail 重复步骤 FF，有时它会给我 “这可能是自动发生的，因为另一个用户从同一浏览器登录”并自动注销前一个用户”，但其他时候只是显示“页面未正确重定向”，我必须清除我的
cookie。Hotmail ，似乎好一点，它立即检测到我已登录第一页并询问我是否要切换帐户，如果我选择切换帐户并返回尝试保存数据，hotmail 会抛出一个错误。登录错误消息。
任何人都可以阐明每个错误的实现方式以及处理此问题的最佳实践是什么？
I'm wondering if anyone knows how exactly Gmail, Hotmail, Facebook etc handles following scenario. (NOTE: Assuming Cookie is shared between tabs)
- Opens two login page to the application.
- User 1 logs in the domain.
- User 1 changes some data without saving it.
- User 2 logs in the domain in a separate tab.
- User 1 switches back to his tab and saves the data.
I tried repeating the steps FF for Gmail, it sometimes gives me
"This may have happened automatically because another user signed in from the same browser" and logs the previous user out automatically" but the other times just shows "The page isn't redirecting properly" and I'll have to clear my cookie.
Hotmail, seems to be a bit better, where it immediately detects that I'm logged in the first page and asking if I would like to switch account. If I selected to switch account and goes back to try to save the data, hotmail throws a login error message.
Anyone can shed some light on how each one is implemented as well as what might be the best practice to handle this problem?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
一般来说，为了解决此类问题，您需要对 cookie 和其他提交的数据中的身份进行交叉引用。因此提交的表单将包含用户 ID，而 cookie 将包含用户会话。如果不一致，则拒绝该尝试，使会话无效，然后让用户登录。
如果您的表单具有 CSRF 保护令牌（应该如此），则 CSRF 令牌还可以对用户 ID 进行编码，因此用户 1 尝试保存其数据将因表单上的 CSRF 令牌无效而失败。
In general, to counteract such issues you'll want to do cross-references of the identity from cookie and other submitted data. So the submitted form will include the user id, and the cookie will include the user session. If those are inconsistent, then reject the attempt, invalidate the session, and send the user to login.
If your forms have CSRF protection tokens (which they should), then the CSRF token can also encode the user ID, so the attempt for user 1 to save their data will fail due to an invalid CSRF token on the form.