How to Securely Send a Request When Closing Tabs
Tags: webdev, javascript, frontend, typescript
Published: 2024-05-19 14:27:06

If the website wants to send analytics after the user has finished the page, but the page may have been unloaded by then, sending an asynchronous request may not be sent by the browser at this point. So what should we do?

First, we might think of the beforeunload event. It enables the web page to trigger a confirmation dialog to ask the user if they want to leave the page. When the user enters unsaved data but accidentally closes the page or refreshes the page, the data will be lost. The use of beforeunload allows the user to confirm twice. Like the screenshot below:

 ![](https://miro.medium.com/v2/resize:fit:579/1*PTMsPUtQ0vN1WuC9Wfag-w.png)

However, clicking Leave or Cancel does not have a corresponding callback function for us to use, so it can only be used as a secondary confirmation.

Next is the unload event. This event is fired when the document is unloaded. It’s after the beforeunload event. If we send an asynchronous request in this event, as I said at the beginning, the browser may choose not to send this asynchronous request, or it may abort this request.

So can we send blocking synchronous XMLHttpRequest requests like below?

 ![](https://media.beehiiv.com/cdn-cgi/image/fit=scale-down,format=auto,onerror=redirect,quality=80/uploads/asset/file/a18d3cd2-6925-440d-b54f-a1868a10a1d9/1.png?t=1715216785)

The answer is yes. But this prevents the document from being unloaded, which slows down the browser to navigate to the next page. The next page can’t avoid this, because the new page looks slow, even if it’s the previous page’s fault.

Similar to this: create an `<img>` element and set its src, create a synchronous loop that does nothing for a few seconds, etc.

So these are not good solutions. Fortunately, browsers provide a targeted API for this — `Navigator.sendBeacon()`

**This event allows profiling data to be sent asynchronously at the end of a page session without delay blocking the loading of the next page. And it guarantees that data is sent reliably.**

Its syntax is this: `navigator.sendBeacon(url [, data])`. data is an optional parameter, it can be an `ArrayBuffer`, a `TypedArray`, a `DataView`, a `Blob`, a string literal or object, a `FormData` or a `URLSearchParams` object.

Here is a simple example:

 ![](https://media.beehiiv.com/cdn-cgi/image/fit=scale-down,format=auto,onerror=redirect,quality=80/uploads/asset/file/e390d42d-8add-44aa-9a57-e06cee93aca4/1.png?t=1715216843)

You can see that I use the `visibilitychange` event here instead of the `unload` or `beforeunload` event. This is because both events are extremely unreliable. It is especially serious under mobile devices, such as when the user closes the browser application using the application manager of the mobile phone, when switching between different applications, etc.

Also, these two events are not compatible with modern browsers’ [back/forward cache](https://web.dev/bfcache/?utm_source=webdeveloper.beehiiv.com&utm_medium=newsletter&utm_campaign=how-to-securely-send-a-request-when-closing-tabs) (bfcache). This is bad for performance. So the best event to signal the end of a user session is the `visibilitychange` event. In browsers that don't support it, the next best option is `pagehide` event, which is also not fired reliably, but which is bfcache-compatible.

Finally, let’s look at the type of data. When we use `URLSearchParams` like above, the request header `content-type` will be set to `text/plain;charset=UTF-8`. Similarly, if we use `FormData`, then the `content-type` of the request header will be set to `multipart/form-data`. But if we use `Blob`, we can customize request headers and request content like this:

 ![](https://media.beehiiv.com/cdn-cgi/image/fit=scale-down,format=auto,onerror=redirect,quality=80/uploads/asset/file/e958aef7-5c22-459a-8eff-9fa462d56f96/1.png?t=1715217153)

Do you know other ways? Feel free to share.

*If you find this helpful, [**please consider subscribing**](https://webdeveloper.beehiiv.com/) to my newsletter for more insights on web development. Thank you for reading!*