Java Practices->Sessions shared across tabs

Sessions shared across tabs

It's important to understand that multiple tabs/instances of the same browser will all share the same server-side session when interacting with the same domain.

Server-side sessions can be implemented in two ways:

browser cookies
URL rewriting

Applications should usually use the following logic to implement sessions:

if the browser has cookies enabled (usually the case), then use cookies to implement sessions.
otherwise, use URL-rewriting to implement sessions, as a back-up. (Using <c:url> consistently will achieve this.)

Each cookie is attached to a domain, and nothing else. So, every time the browser interacts with that domain, the cookie is sent to that domain's server. For a given browser, the same cookie is sent for every tab/instance that interacts with that domain.

As a consequence, with a given client and browser, there's no way to have multiple sessions at the same time.

If the user has multiple accounts, and logs in a second time with a different account, on a different tab, then they are actually overwriting the first login.