A certain tax website has the frustrating feature of limiting the session to only one browser tab or window at a time. I haven't looked into how they might be doing this, but if you login on one tab, then open another tab and go to the same URL, you are logged out of your session on both tabs. They claim...

Tax returns contain sensitive information, and so our security procedures are stricter than you may see on other websites. You won't be able to have two tabs open in the same account.

Does this actually provide any additional security? If so what type of attack would take advantage of this? (My hunch is it is just a limitation of how they're managing state in their single-page web app.)

  • This just sounds like the behavior of some old (possibly mainframe-integrated) web applications that don't do proper session management. – multithr3at3d Mar 8 at 0:16

Limiting the session to apply to only one tab can be a useful protection, even though it comes with a usability downside that probably makes it not worth it in most cases.

Some attacks (e.g. reflected XSS, CSRF or clickjacking) rely on the attacker tricking the victim into clicking a link. The risk of the victim clicking such a malicious link is decreased if it has to be done in the tab with the open session. In the same way that logging out when you are done protects you over time, keeping the session to one tab protects you over "space".

So limiting the session to one tab can sort of make sense. What I don't get is why you would be logged out in both tabs when you open a second tab, insead of not just being logged out in the second tab. Maybe they wanted to get the security benefits I describe above and couldn't figure out a better way to do it? Or maybe you are right, and they are just using security arguments to cover up bad design.


It is snake oil. Not allowing more tabs does not provide more security.

We can only guess what was the real reason for such implementation. May be the developers of their web application struggled to define a reasonable architecture. For instance they might have implemented CXRF protection poorly and server could consider requests from another tab as invalid. Instead of doing it properly they may have decided to prohibit more than one tab.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.