Fixing Multi-Tab Session Conflicts with Single Active Session Management in Web Applications
Engagement Highlights
- Identified and resolved issues caused by multiple simultaneous browser sessions per user.
- Implemented Multi-Tab Session Management in Web Applications to prevent session conflicts and enforce a secure single active session per user.
- Eliminated sensor state mismatches across tabs and browser instances.
- Enhanced user experience by ensuring accurate and synchronized data display.
Company Introduction
Shooter Detection Systems (SDS) is a leader in gunshot detection technology, providing real-time alerts to enhance safety and security. The Guardian Indoor Active Shooter Detection System incorporates the world’s finest acoustic gunshot identification software and combines it with infrared gunfire flash detection to produce the highest performing, fully automatic, and most accurate gunshot detection technology available today. With millions of hours of use, The Guardian Indoor Active Shooter Detection System has delivered a fantastic detection rate, without a single false alert, and a perfect operational record.
Challenges
The absence of proper web application session control resulted in race conditions, stale token usage, and inconsistent sensor data across browser tabs.
- Sensor State Issues:
- Sensors added in one tab did not appear immediately in another.
- A sensor could show as active in one tab and inactive in another.
- Sensor counts were sometimes incorrect.
- Data Synchronization Delays:
- Users had to manually refresh the page to see updates.
- Real-time consistency was missing.
- Conflicting Operations:
- One tab could start a sensor while another tried to stop it.
- Parallel actions caused race conditions.
- The system could not decide which request should take priority.
- Session Ownership Confusion:
- The system could not determine which tab was the main session.
- Users sometimes worked in an outdated tab without knowing it.
- Operational Impact:
- Increased support tickets.
- More bug reports related to incorrect sensor data.
- Time spent investigating inconsistent behavior.
Solutions
Instead of trying to keep multiple browser tabs perfectly synchronized, we chose a simpler and more reliable approach by implementing Multi-Tab Session Management in Web Applications. We introduced a token invalidation mechanism to prevent multiple login sessions and enforce secure session management across browser instances. Each user is restricted to a single active session. When a new login occurs, the previous session is automatically deactivated, preventing conflicts and ensuring clear session ownership.
- Frontend Improvements:
- Added a confirmation pop-up when login is detected in another tab.
- The pop-up clearly informs the user that the previous session will be disconnected.
- Stored token and username in Session Storage for tab-level isolation.
- Implemented Server-Sent Events (SSE) for real-time session updates.
- Displayed a clear message when a session becomes inactive.
- Disabled all actions in inactive tabs to prevent further changes.
- Backend Improvements:
- Implemented a token expiration mechanism.
- When a new login occurs, the previous token is invalidated.
- Only the latest token is authorized to perform operations.
- Blocked stale or parallel requests from modifying sensor data.
- Ensured one authoritative session controls the system state.
Business Impact
- 100% elimination of sensor mismatches.
- Improved data accuracy and integrity.
- Reduced user confusion.
- Decreased session-related support tickets.
- Improved security by preventing unintended parallel access.
- Created a reusable session control pattern for other modules.
Related Projects
Streamlining User Interface Quality in Gunshot Alert Systems
End-to-End testing for an IoT Security Product
