The website I'm developing for uses a mixture of .NET (aspx), Javascript and jQuery. Looking into a vulnerability that's a result of the following scenario:

1. User A logs into www.example.com.au whilst having multiple different tabs open.
2. User A closes the tab that's logged into the above website, but not the browser.
3. User A then leaves the computer.
4. User B sits at the same computer/same browser session and goes to www.example.com.au, giving User B full access to User A's account.

While there is a server-side timeout for the user's session after 10 minutes of inactivity, that's still a window in which this vulnerability can be exploited, albeit niche. My first stab at this consisted of:

1. JavaScript that utilises the onbeforeunload event to set a localStorage flag to true. Creation of this flag is done on the login screen (separate application).
2. Another JavaScript then checks if the flag is true after the loading of every page within this website, and if so logs them out. I've had to whitelist various elements to ensure this doesn't trigger on every page unload.

CODE SNIPPET: (code here)

For the most part I have success, but I had very inconsistent unloads (triggering the logout) when interacting with span/option elements that load another screen. I knew of onbeforeunload's jankiness from browser to browser/version to version, but at the time it was the only idea that (mostly) worked, so my question is:

Is there a better way to solve this kind of vulnerability within the stack being used? Any conceptual suggestions or even code snippet examples would be amazing. I'm a fairly new developer and want to learn.