是否有跨浏览器窗口跟踪用户会话的常见做法？
我正在编写一个网站，本质上是一个客户端 Web 应用程序，即页面上的所有内容均由带有来自 ajax API 的数据的脚本填充。用户还可以使用一组 API 进行登录和注销。
我的问题是如何处理以下（但不是很极端）用例：
- 用户打开浏览器选项卡 A 并转到网站并以用户 #1 身份登录。
- 用户打开浏览器选项卡 B 并访问该网站。由于存在 get_session API，因此该脚本会恢复选项卡 B 上的会话。
- 用户从选项卡 B 注销，同时选项卡 A 保持打开状态。
- 用户有时会忘记选项卡 A，然后返回并与选项卡 A 进行交互。
- 选项卡 A 中的脚本尝试以用户 #1 的身份获取新数据，但遇到错误。
理想情况下，在步骤 3 中应该有某种方式，当用户单击选项卡 B 中的“注销”时，选项卡 A 也会自行注销。
可以在步骤 5 中注销选项卡 A（GMail 就是这样做的），但我认为应该有一个更好的方法。即使在步骤 5 中进行检查也很重要，因为这样的设计每个 API 都必须准确知道脚本正在请求哪个用户的数据，否则下面的用例将生成不正确的输出。
(1-3)同上。
- 用户打开浏览器选项卡 A 并转到网站并以用户 #1 身份登录。
- 用户打开浏览器选项卡 B 并访问该网站。由于存在 get_session API，因此该脚本会恢复选项卡 B 上的会话。
- 用户从选项卡 B 注销，同时选项卡 A 保持打开状态。
- 用户从选项卡 B 再次登录，但这次以用户 #2 身份登录。
- 用户返回选项卡 A 并进行交互。当认为用户是用户 #1 时，选项卡 A 中的脚本从 API 请求数据。
- API 返回属于用户#2 的数据。 繁荣。
是否有预防此类问题的常见做法？谢谢。
蒂姆
I am writing a website that is essentially a client-side web app, i.e. everything on the page is populate by scripts with data from ajax APIs. Users would be also signing in and signing out using a set of APIs.
My question is about how do deal with the following (but not quite extreme) use case:
- User opens browser tab A and go to the website and logged in as user #1.
- User opens browser tab B and also go to the website. Since there is a get_session API, the script restores the session on tab B.
- User logged out from tab B while leaves tab A open.
- User forgets about tab A for sometime, and go back and interactive with tab A.
- Scripts in tab A attempts to fetch new data as user #1 but encounter error.
Ideally, there should be some way in step 3 that the tab A would also log itself out when user clicked logged out in tab B.
It's possible to log out tab A in step 5 (GMail do that), but I think there should be a better way. Even checking in step 5 would be non-trivial, cause for such design every API must know exactly which user's data the script is requesting, or the below use case would generate incorrect output.
(1-3) same as above.
- User opens browser tab A and go to the website and logged in as user #1.
- User opens browser tab B and also go to the website. Since there is a get_session API, the script restores the session on tab B.
- User logged out from tab B while leaves tab A open.
- User log in again from tab B but this time as user #2.
- User goes back to tab A and interactive. While thinking the user is user #1, the script in Tab A request data from API.
- API returns data that belongs to user #2. Boom.
Is there a common practice to prevent these kind of problem? Thanks.
Tim
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
ajax 响应应指示用户已注销作为错误条件；在客户端，检测此错误并执行适当的操作。显然，这只在有 ajax 响应时才有效，因此您可能想要实现某种“心跳”机制，即客户端每隔几秒向服务器发送一条类似 ping 的 ajax 消息。当您注销时，服务器将以“用户已注销”错误响应心跳，并且客户端可以进入“未登录”模式。
The ajax response should indicate as an error condition that the user has logged out; on the client side, detect this error and perform the appropriate action. Obviously this only works when there is an ajax response, so you might want to implement some kind of 'hearbeat' mechanism, that is, the client sends a ping-like ajax message to the server every few seconds. When you log out, the server will respond to the heartbeat with a 'user logged out' error, and the client can go into 'not logged in' mode.
我认为不存在，因为页面（选项卡）之间的这种通信将是一个重大的安全漏洞。
但是，您可以通过让每个页面（选项卡）轮询服务器以查看会话是否仍然有效来实现相同的效果。或者使用一种事件处理技术，例如长轮询或在 iframe 中进行流式处理。
I don't think there is, because such communication between pages (tabs) would be a significant security weakness.
However, you could achieve the same effect by having each page (tab) polling the server to see if the session is still valid. Or use one of the event-handling techniques such as long-polling or streaming in an iframe.