When should the authenticated user be reset?

Question

In my web application, I have used the asp Login control to facilitate the login process. I have noticed that if I open the site in a browser and log in, and then open another browser and go to the site, then the second browser shows that I am already logged in, even though I didn't log in using that browser. I have noticed that some other sites (such as my bank's web access) work this way, but it still seems odd to me. I'm not sure if it's bad or not, but it is strange.

Is this behavior bad?

I have also noticed that if I close all of my browsers and then open a new one up and go to the site, I am NOT logged in.

Answer 1

This is because those sites use session cookies. If you open different brwosers at the same time, such as FireFox, Opera, Chrome and IE, you'll have to log in in all of the browsers independently. However, when re-using the same browser application, this usually does not spawn a new process with its own session data but rather re-uses the already open browser.

Answer 2

If you are using a browser that supports multi-tabbed sessions e.g. IE7+, Firefox etc, you will find that, if you have the same ASP.NET website open in multiple tabs, each tab will share the same authentication credentials. This is because the session ID applies to the browser instance, not the tab instance, so if a user logs in on 1 tab, then opens up another tab to the website, they won't have to provide their credentials twice.

I don't think there's an easy way around this behaviour. You could choose employ cookie 'munging', storing the forms authentication ticket on the URL, but this seems like a bad idea from a security POV.

Answer 3

Lucero and pmarflee are both correct.

To provide a bit more information though:

Firefox will share session between tabs and all browser instances

IE 8 will also share session between tabs and all browser instances

IE 7 shares session between tabs, but not across instances

IE 6 does not share session across instances

I'm not sure how Opera, Chrome, or Safari handle sessions.