266484 - Does not prompt for password if an instance of browser is running

Status: RESOLVED INVALID

(SeaMonkey :: General, defect)

Description

[Virtuo]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; rv:1.7.3) Gecko/20041001 Firefox/0.10.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; rv:1.7.3) Gecko/20041001 Firefox/0.10.1


      I had this issue opening my company outlook web email over a secure
connection. It prompted for the user name and password for the first time. I
read the mail and closed the browser window. But there is another browser window
open with yahoo mail. when i opened the outlook again in a new window it doesn't
ask me for the user name and password. It directly takes me into the mail. This
happens only if there is another window is open with any website.

Reproducible: Always
Steps to Reproduce:
1. Open two browser windows (or tabs) and open any website in one window.
2. Open any secure website that prompts for user/password in the second window 
   and login. ( I am opening the outlook web mail)
3. close the secure window and open another new browser window. 
4. Access the secure site in the second step again.

Actual Results:  
It directly takes me in without asking for user/password.
   

Expected Results:  
Should have prompted me for user name and password.

Comment 1

[Matthias Versen [:Matti]]

This is either a dupe of the cookie session enhancement bug or the logout basic
out bug. This is no security bug, it's by design (you get the same in IE if you
open two IE windows with CTRL+N)

Does outlook web use cookies or basic Authentification for the login ?

Comment 2

[OstGote!]

*** Bug 268464 has been marked as a duplicate of this bug. ***

Comment 3

[Matthias Versen [:Matti]]

from the dupe : It's with Basic authentification

This is by design, you have always the same session if you open Mozilla or
Firefox. In IE you get a different instance of the browser if you click on the
IE Icon on the Desktop.

You can manually logout in mozilla with "Tools/Passwort Manager/logout" 
(bug 55181) but that doesn't work in Firefox. 

This is invalid (by design) as reported Mozilla bug.

BTW: You can add comments to a bug if you write your comments in the "additional
comments" field and hit the commit button.

Comment 4

[Matthias Versen [:Matti]]

bug 117222 is for cookies...

Comment 5

[Virtuo]

(In reply to comment #4)
> bug 117222 is for cookies...


I am little confused with this. What you are saying is if i open a website that
uses Basic auth i have to close all the instances of the browser even thought i
am using other windows to browse some other web sites ?. Let me confirm again.
This is what i was doing.
 
 I started a browser instance from the desktop shortcut and opened my mail which
is using the basic auth.

 Then i thought i will check out whats happening in the market and i opened
yahoo finance in completely new browser window lauched from the desktop link.

After i am done with reading my mail, Do i have to close the "yahoo finance
window" also to make it ask for username/password next time i access the mail ?

  whats happening here is i am leaving the yahoo window open (because it has
nothing to do with my mail) and if anyone else tries to access the mail it
directly takes them into the my mail account. Is this by design ?
 

Comment 6

[Matthias Versen [:Matti]]

>I am little confused with this. What you are saying is if i open a website that
>uses Basic auth i have to close all the instances of the browser even thought i
>am using other windows to browse some other web sites ?. Let me confirm again.

You need only to close THE one Instance because you have always ONE instance of
Firefox/Mozilla and not more. One instance with other brwoser windows from the
same Instance.

That Mozilla/Firefox is using only ONE instance is by design.
One instance means also that Basic Auth is still cached unless you close that
instance.
IE does the same with the difference that you have more than one instance if you
click the IE Icon on the desktop.

You are free to create an enhancement that Mozilla should use more than one
instance with the same profile if you click on the icon. (More than one instance
is already possible with one browser profile per instance) but I don't think
that such an RFE will be fixed in the near future.

Comment 7

[Virtuo]

(In reply to comment #6)
> >I am little confused with this. What you are saying is if i open a website that
> >uses Basic auth i have to close all the instances of the browser even thought i
> >am using other windows to browse some other web sites ?. Let me confirm again.
> 
> You need only to close THE one Instance because you have always ONE instance of
> Firefox/Mozilla and not more. One instance with other brwoser windows from the
> same Instance.
> 
> That Mozilla/Firefox is using only ONE instance is by design.
> One instance means also that Basic Auth is still cached unless you close that
> instance.
> IE does the same with the difference that you have more than one instance if you
> click the IE Icon on the desktop.
> 
> You are free to create an enhancement that Mozilla should use more than one
> instance with the same profile if you click on the icon. (More than one instance
> is already possible with one browser profile per instance) but I don't think
> that such an RFE will be fixed in the near future.
> 

(In reply to comment #6)
> >I am little confused with this. What you are saying is if i open a website that
> >uses Basic auth i have to close all the instances of the browser even thought i
> >am using other windows to browse some other web sites ?. Let me confirm again.
> 
> You need only to close THE one Instance because you have always ONE instance of
> Firefox/Mozilla and not more. One instance with other brwoser windows from the
> same Instance.
> 
> That Mozilla/Firefox is using only ONE instance is by design.
> One instance means also that Basic Auth is still cached unless you close that
> instance.
> IE does the same with the difference that you have more than one instance if you
> click the IE Icon on the desktop.
> 
> You are free to create an enhancement that Mozilla should use more than one
> instance with the same profile if you click on the icon. (More than one instance
> is already possible with one browser profile per instance) but I don't think
> that such an RFE will be fixed in the near future.
> 


   Thanks for your explanation. It is very clear now. 

We had this problem earlier with Netscape ( Netscape used to be the corporate
standard in our company until last year) while developing an application and we
finally decided to go with only IE compatible approach.

 Anyway, thats how it works.

  Cheers,
    Virtuo

Comment 8

[Matthias Versen [:Matti]]

You can logout manually in Mozilla (tools/passwort Manager/log out) but not in
Firefox and this also doesn`t delete the session cookies.