288957 - Mozilla 's tabs share same session_id of a web application

Status: RESOLVED DUPLICATE of bug 117222

(Firefox :: Security, defect)

Description

[ahmailab]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.7.5) Gecko/20041110 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.7.5) Gecko/20041110 Firefox/1.0

Tested for both server-technologies  ASP/IIS and  JSP/TOMCAT.(My)web pages is
using  session variables ; user_id for example, when entering a new session
(with the first tab in the browser) 'user_id' is given a value(what ever is!)
and then when openning a new tab and trying the same page used in the first tab,
so i find that the second tab is using the SAME VALUE of session's variables
'user_id' of the first tab.


Reproducible: Always

Steps to Reproduce:
1. open page(wish using a session's variable) in first tab.
2. open the same page in a second tab


Actual Results:  
second tab is using the SAME VALUES of the session's variables of the first tab.

Expected Results:  
new tab should behave as new Mozilla instance.

Web Server (IIS, TOMCAT(apache),...) does'nt detect tabs !!!

Comment 1

[Daniel Veditz [:dveditz]]

A new tab will never behave as a new instance; last time I tested this in IE
it's equivalent to opening a new IE window from the IE menu or from a javascript
window.open() -- same shared instance.

In fact we never have multiple instances of Firefox or Mozilla, even for
separate windows. Duping to that bug.

*** This bug has been marked as a duplicate of 117222 ***

Comment 2

[ahmailab]

(In reply to comment #1)
> what i mean with 'new instance' is launching a NEW SESSION with SERVER, cause
i think that server is dealing with Mozilla not the tabs of Mozilla, otherwise
SERVER  generate session_id  for the first tab, and others tabs are using the
same session_id,  because :
SERVER DO NOT GENERATE a new id for each new one ===> SERVER  THINK IT'S ABOUT
THE   SAME CLIENT(MOZILLA not the tabs) 

The ramarque about IE: popup and new window are differents: popup use the same
session_id but surely not for new window. 

Comment 3

[:Gavin Sharp [email: [e-mail]]]

Server side sessions use cookies. Mozilla shares cookies among all of its
windows, while Internet explorer allows multiple instances based on how you
start it.

*** This bug has been marked as a duplicate of 117222 ***