Random, unauthorized users are automatically joining my private two-player game sessions on Heroku without having access to the session links.

I'm hosting a two-player program (Trust Game) on Heroku. When I create a session with 100 participants, despite not sharing the links with anyone, unknown users are:

- Automatically joining the sessions
- Taking up player roles (specifically the trustee role)
- Preventing the game from proceeding

e.g., when I use the link to get the trustor role, someone I don't know will join this group and get the trustee role without any move, hence the program can't move forward.

Any advice would be greatly appreciated.

It sounds rather unlikely that “unauthorized users” are joining your sessions without having access to the session links.

You wrote that you have not shared the links with anyone. Are you sure that this is the case?

What I mean is that, for instance, when you send a URL to yourself or to a coauthor, say, via WhatsApp, WhatsApp will try to create a “screenshot” of the respective webpage. For this purpose, it will access the URL. In your case, this can lead to the observed behavior: “Someone” will access the first page of your game and will never move forward from that page.

A solution might be to insert a landing page as the very first page on which participants have to make some entry—at least clicking a “Continue” button. And only after they have left that page, the assignment of the two roles and the grouping is carried out.

Thank you so much @BonnEconLab, that's exactly what has happened. I didn't send the URL to anyone, but I did send it to myself through email or WhatsApp. I meant to do an online study, if this happens every time one real participant accesses to the task, then there will be no chance to do this online. In this case, do you have any suggestions on what I should do to solve this?

Great! I will try this solution, it's really appreciated! @BonnEconLab