14 Replies Latest reply on May 20, 2007 7:54 AM by 60437

    When users open links in a new window

    Tony Andrews
      We have a report that shows many rows of data together with a link to drill down on a particular row by branching to another page, passing the row PK as a parameter - standard stuff.

      However, some of our users like to use the browser facility to open the link in a new window. They then go back to the report and maybe open another link in another new window.

      Now they have 2 new windows open, supposedly showing 2 different sets of data. But since the windows share the same SESSION value, the session state gets mixed up. If they click the 2 links quickly enough they can even end up with the same data displayed in both windows.

      I realise that I can avoid this by NOT passing the session ID. But since the user could do this with any link, that means NEVER passing the session ID in any link, so effectively not having any persistent session state.

      Is it possible to:
      - prevent the user from opening the link in a new window?
      - recognize that the user has opened the link in a new window and start a new session?

      This must be a potential issue for all ApEx applications, so I am sure someone has solved it already!
        • 1. Re: When users open links in a new window
          VANJ
          Now they have 2 new windows open, supposedly showing
          2 different sets of data. But since the windows
          share the same SESSION value, the session state gets
          mixed up.
          How do you mean "mixed up"? Please clarify.
          If they click the 2 links quickly enough
          they can even end up with the same data displayed in
          both windows.
          If you use the builtin popupURL function to popup your windows, it will only create 1 named window. If you leave that popped up window open and click another popup link, the contents of that popup window are replaced, another window is NOT created.
          • 2. Re: When users open links in a new window
            60437
            The problem happens when users deliberately open multiple windows off links, all in the same AppEx session, e.g., using IE's CTRL+N. Pages that alter session state during rendering can step on each other. There is no ready solution to this now, but we're thinking about it.

            Scott
            • 3. Re: When users open links in a new window
              Tony Andrews
              OK, thanks. It's quite a big issue for us as it could lead to data corruption by users who think they are updating a different record to the one they in fact are.

              Since it seems that this must affect all ApEx applications, I wondered what would happen if I tried it on AskTom. Using Firefox, from the AskTom front page I quickly opened two of the threads in new tabs. They both appeared OK. Then I clicked the "Let Us Know" link in both new tabs as if to respond. Again, both showed correct information. I don't know what would have happened if I submitted both pages because of course I didn't try that! I suspect both responses would have been linked to the same thread.

              I'm now wondering how the AskTom application managed to render the 2 pages simultaneously without getting confused. Perhaps in reality the two pages got rendered in series?

              In the meantime, if anyone has any suggested work-arounds I'd be interested to hear them.
              • 4. Re: When users open links in a new window
                Tony Andrews
                Another way users can end up with the same session in 2 browser windows is by saving a page in their browser "Favorites" and then using that to start the application. I'm not sure what we can do about that, other than urge them not to.

                Unless we can find a way to resolve these issues it seems we are going to have to stop relying on session state as far as possible in our application. Otherwise accidental data corruption can and will occur.
                • 5. Re: When users open links in a new window
                  VANJ
                  I think your best bet (for now) is to disable the Open in New Window option in Internet Explorer (both Ctrl-N and right-click context menu one).

                  Googling around for it http://www.google.com/search?hl=en&q=ie%20disable%20%22open%20in%20new%20window%22&btnG=Google+Search
                  shows quite a few shareware products that claim to do just that by tweaking the registry settings.

                  Also see
                  http://www.windowsnetworking.com/kbase/WindowsTips/WindowsNT/RegistryTips/IEandExplorer/ControlInternetExplorerSettings.html
                  • 6. Re: When users open links in a new window
                    Tony Andrews
                    Actually, I have been looking at ways of detecting that a new window has been opened using Javascript - like this:
                    <script type="text/javascript">
                    function checkIfSpawned() {
                      var lsBrowser = navigator.appName;
                      var lsNumPages;
                      if (lsBrowser.indexOf("Microsoft") >= 0)
                        lsNumPages = 0;
                      else
                        lsNumPages = 1;
                      if (history.length <= lsNumPages) location.replace('f?p=103:4');
                    }
                    </script>
                    i.e. if there is no browser history then bring up a special page instead that simply says "sorry, you can't open this page in a new window".

                    However, there are other ways to end up with the same session in two or more browser windows (saving page including session_id in Favorites, simple cut and paste...) so I am still looking for other ideas. I think there are two ways in which this can be a problem:

                    1) Opening the same page with different parameters in two windows simultaneously: the second overwrites the session state of the first, but the first is still rendering and reading the session state. I am exploring whether we can detect that that has happened somehow and raise an error in the corrupted window. For example, perhaps we can save the parameter values into package variables in an On Load, Before Header process and then compare the session state and package values in an On Load, After Footer process: if they are different, the page has been corrupted and we raise an error. (I am very much thinking aloud here, I haven't tried anything yet).

                    2) With two windows open with same session_id (however that occurs): we cannot rely on the values in session state, only on values in items that are part of the current page. For example, if we have a 2-page wizard with pages 1001 and 1002, then we should not refer to P1001_XXX items when in page 1002. So we have to pass the values from 1001 to 1002 either as parameters, or perhaps by storing them in a table associated with a unique sequence value generated for the transaction, and then passing the sequence value as a parameter. (Again, thinking aloud here).
                    • 7. Re: When users open links in a new window
                      Tony Andrews
                      Scott,

                      I'm trying to replicate my problem in a simple application, and failing. The page takes a key value (a username) as a parameter and has a few regions to select data related to that key value. I have ensured that some of the queries are quite slow, so that it takes about 8 seconds to build the page.

                      I then open the following URLs in quick succession in separate windows, so that they are running simultaneously:
                      f?p=111:2:141593584673961360::NO:2:P2_USERNAME:ANDERSON
                      f?p=111:2:141593584673961360::NO:2:P2_USERNAME:ARMOUR

                      When the pages have finished loading I fnd that the first correctly shows data for ANDERSON and the second correctly shows data for ARMOUR, though of course only ARMOUR is now held in session state.

                      Can you explain why it doesn't go wrong? In my real example (production system) the second page always trashes the first. Maybe this points at some way to change the production system to reduce the likelihood of corruption?
                      • 8. Re: When users open links in a new window
                        60437
                        Tony - This seems plausible. Each page uses the value passed into it. Even if that value changes in session state during page rendering, the original value (in database session package variables) will be used throughout the page view. The committed session state values at any point during that page view might change, but these are not propagated into the package variables in other database sessions (the concurrently running requests).

                        Scott
                        • 9. Re: When users open links in a new window
                          Tony Andrews
                          Scott,

                          Thanks, that explains why I can't replicate the problem.

                          However, in our real application we do have a page that, if opened twice simultaneously in this way, shows the same data in both windows for report regions that have sources like this:

                          select call_reference, customer_code
                          from support_calls
                          where log_no = :p11_log_no

                          So it seems to start refering to saved session state even while rendering the page. How can this be?
                          • 10. Re: When users open links in a new window
                            60437
                            If there is anything that sets an item in session state like a process, computation, a page-submitting item, a call to update_cache_with_write, these will commit the new value to the session state table so that it will be visible to other page views using other database sessions. Running the page in debug mode will show you if any events like that are happening (as will inspecting the session state popup report after the page is shown).

                            Scott
                            • 11. Re: When users open links in a new window
                              Hendrik Schmidt-Oracle
                              Is this problem reproduceable on MS IE only?
                              In Fire fox new window will notclone the old window , it will open in the new window the default page from the browser
                              • 12. Re: When users open links in a new window
                                Tony Andrews
                                No, it can happen in IE, Firefox, any browser. It isn't any attribute of the window that causes the problem, it is the fact that you now have two windows (or tabs - same issue) in which you are running ApEx with the same session_id. The user thinks he has two separate ApEx sessions, but in fact he only has one. Actions in one window have an impact on the session state used by the other.
                                • 13. Re: When users open links in a new window
                                  Tony Andrews
                                  The problem happens when users deliberately open
                                  multiple windows off links, all in the same AppEx
                                  session, e.g., using IE's CTRL+N. Pages that alter
                                  session state during rendering can step on each
                                  other. There is no ready solution to this now, but
                                  we're thinking about it.

                                  Scott
                                  Has there been any progress on this?
                                  • 14. Re: When users open links in a new window
                                    60437
                                    Not much. There was a 3.0 enhancement having to do with simultaneous access to public pages. The situation prevented is where multiple users access a public page with a bookmarked link containing the same session ID causing them to access the same apex session at the same time. The fix relies on the IP address of each client (as seen by the application) being different. Sometimes this is not the case even when there are two distinct physical clients, but the fix should help prevent some of these occurrences.

                                    Scott