296564 - ASP sessions are not terminated on client side after closing browser.

Status: RESOLVED DUPLICATE of bug 117222

(Firefox :: Security, defect)

Description

[Christopher Thilges]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

ASP sessons are not terminated on client side after closing the browser.  This
could be a major security bug if someone was working on a public computer.  

The problem would occur when someone logged into a secured site which uses asp
session variables for authentication, and that user did not log out but simply
closed the browser window.  Until the server's session timeout, which is usually
20 minutes, anyone can reopen firefox and have access to those pages that
required a login.

This is not dealing with wasted resources on the server side for clients who
close their browser but never logout.

Reproducible: Always

Steps to Reproduce:
1.Log onto a site that uses asp session variable for authentication.
2.Close the browser.
3.The next person to open the browser and visit the same restricted pages before
the session timeout (usually 20 min) will have access as the previous user.

Actual Results:  
Gained previous users accessibility levels on asp session authenticated pages.

Expected Results:  
Firefox should clear all session variables on client side and use a new session
id on next startup.

The session is ended if the user clears their cookies:
tools/options/privacy/cookies/clear

Currently the only foilable solution seems to include detecting a browser close
with javascript: http://www.asp101.com/articles/john/sessionsend/default.asp

There may be a way to close session objects on browser close using asynchronous
data thru asp.net.

Submitted by: Christopher Thilges, [e-mail]
http://web.ics.purdue.edu/~cthilges/

Comment 1

[Christopher Thilges]

(In reply to comment #0)
Me again, 

This bug only happens when a browser window is left open.  The current firefox
approach makes sense for tabs or spawned windows, but not for seperate windows.
 I wonder if I can move a window offscreen ...

Comment 2

[:Gavin Sharp [email: [e-mail]]]

(In reply to comment #1)
> This bug only happens when a browser window is left open.

Ah ha, that would make it a dupe of bug 117222.

Comment 3

[Gervase Markham [:gerv]]

This is an automated message, with ID "auto-resolve01".

This bug has had no comments for a long time. Statistically, we have found that
bug reports that have not been confirmed by a second user after three months are
highly unlikely to be the source of a fix to the code.

While your input is very important to us, our resources are limited and so we
are asking for your help in focussing our efforts. If you can still reproduce
this problem in the latest version of the product (see below for how to obtain a
copy) or, for feature requests, if it's not present in the latest version and
you still believe we should implement it, please visit the URL of this bug
(given at the top of this mail) and add a comment to that effect, giving more
reproduction information if you have it.

If it is not a problem any longer, you need take no action. If this bug is not
changed in any way in the next two weeks, it will be automatically resolved.
Thank you for your help in this matter.

The latest beta releases can be obtained from:
Firefox:     http://www.mozilla.org/projects/firefox/
Thunderbird: http://www.mozilla.org/products/thunderbird/releases/1.5beta1.html
Seamonkey:   http://www.mozilla.org/projects/seamonkey/

Comment 4

[:Gavin Sharp [email: [e-mail]]]

*** This bug has been marked as a duplicate of 117222 ***