Question

Scenario:

I have an administration-application which manages the user accounts for another application. Now I would like to place an user-specific-link (e.g. Click here to login with user1) in the administration-application allowing the admin to directly log in with the user in a separate browser window or tab (target="_blank").

Problem:

When the admin clicks two or more links and opens two tabs with tab1=user1 and tab2=user2, the last clicked tab overwrites the session-variables of all other tabs. Sure… that’s how sessions work, but I wonder if there is a way to let the admin manage multiple user interfaces with one session in multiple tabs? But I don’t see a possibility to identify a specific tab in the browser so that I could say “in tab1 is user1 and in tab2 is user2 logged in …

Question:
Has anyone done something similar and likes to share the basic idea of solving this?

---

EDIT:

One possible solution could be to add an parameter to the URL with the userid and hand it through to every page, right?

Answer 1

As your edit points out, the way to do this is with a url variable that specifies who the user should be.

There are a number of security issues with this approach tho.

I’m assuming that your initial link is doing some sort of security check to make sure that the initial “log in” of the user is an authorized request. You’ll need to do a similar thing for this method. If your initial request is something like http://example.com/page.cfm?userid={id}&authtoken={encryptedtoken} I would then put that userid into the session scope as a valid userid that the admin can impersonate. The more links they click on the more users they can impersonate. On subsequent requests you check the requested userid against the allowed list in the session and either allow or deny the impersonation.

You’ll also need to update all the links on the site so that they include the userid in them. The easier way to do this is to cheat and user jQuery or such to rewrite all internal urls with the userid appended. You would conditionally include that javascript based on the above check.

Lastly you’ll likely want to prevent these urls that include the userid from appearing in search engines, if it’s not a fully locked down site. You’ll either need to use canonical urls to remove the userid, or set x-robots headers to tell search engines not to index the urls where the userid has been specified; or both.

That’s the most primitive method of getting different “sessions” for multiple users in the same browser. However you’ll then bump into issues if you’re using the session scope for anything meaningful, because each tab will try overwriting the other. You’ll need to overwrite the normal site session variables on each request, or you’ll need to create different structures in the session scope for each userid that is used. How much of a problem this is depends on your application.

It’s a do-able thing, but probably a lot more work then you were hoping for.

The other option is to get the admins to use Google Chrome with multiple profiles and copy and paste the login url into different profile windows. A slight inconvenience for them, but a lot less work for you.