One site, one user, two windows: how to keep status straight?

[jhsachs]

I've got a site that requires the user to follow a well-defined workflow, corresponding to a sequence of pages. You'll have the right idea if you think of a store where the user selects items, then chooses a delivery method, then pays (although the site's actual purpose is somewhat different than that).

 

I just tracked down a puzzling logical failure: a user followed the workflow up to a certain point, then opened a new browser window, pointed it to the site, and started a second workflow. The site stores information about the user's activities in session variables, and the two windows shared a single session, so the site got tremendously confused about what the user was doing.

 

Given the site's design, visiting the site in two windows at once is a legitimate thing for a user to do. I'm darned if I see how I can accommodate it, though.

 

Other designers must have dealt with this problem many times. What ways of solving it have been found effective?

 

In this case, the simplest and most effective solution would be to create a new session for each window in which the user visits the site. Is there any way to do that?

[kicken]

You can simulate separate sessions by storing all your data for the user in a particular key inside the $_SESSION array, then pass that key around throughout the process.

 

eg:

do {
   $key = uniqid();
} while (isset($_SESSION[$key]));

$_SESSION[$key] = array(); // store all the data in here

 

Then just pass around $key either in the URL or as a hidden input.  You have to pass it manually as it is the only way you'll be able to tell the windows apart.  Both $_SESSION and $_COOKIE are shared among all tabs/windows.

 

[jhsachs]

That sounds like a pretty good solution.

 

I assume there would be no problem using POST instead of GET? (I'm concerned that a user might try to launch a new session by copying the URL from one window to the other, which would defeat the mechanism if it used GET.)

[kicken]

Using post would work just as well.  If it is setup so that in order to start a second process they have to go through a specific page then that page could just generate a new key regardless of whether there is an existing one in the url or not.

 

[jhsachs]

It doesn't work that way, but it shouldn't be hard to generate a new key if none is provided. Session management is already handled in a .inc file that all of the scripts include, so that shouldn't require much redesign.