Session staying open when I close the browser

Question

I have a user control that stores in an Applitioscope a list of users logged in to the system. Together with each user, I save the session id that it is logged in. Each session lasts around 20 without the user messing with the system. I do not allow the same user with different session id to avoid conflict in operations. If I call the login screen and there is already a login id in the system, I automatically recover the user and redirect to the system home screen. If there is already a logged-in user with a different session id, a question is asked if you want to take down the other system session.

My problem is that when I close the browser, the session remains open on the system, and when I open the same browser again the session id is changed and identifies as if it already had another user logged in to the system. I wanted to when to close the browser log out of the system. I was using the remote onbeforeunload but it is triggered when I update the screen and when I call a new screen.

It would be possible to verify that there is no browser logged in with the session (Httpsession) that is in the Applitionscope list?

Or maybe check if the tab or browser is actually being closed and not updated?

Answer 1

I think the model you chose (one session per user) generates a very high cost of control for a very small benefit value. You’re basically fighting the multi-device identity paradigm.

Given the very nature of the HTTP protocol and the behavior of browsers (where a permanent connection to the web server is not guaranteed), I would try another approach: allow a user to have one or more sessions. Map your operations per session, not per user.