376605 - Yahoo and gmail don't require password when i close and restart firefox

Status: VERIFIED DUPLICATE of bug 345345

(Firefox :: Security, defect)

Description

[8anos]

User-Agent:       Opera/9.10 (X11; Linux i686; U; en)
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.2) Gecko/20070220 Firefox/2.0.0.2

see at steps to reproduce it


Reproducible: Always

Steps to Reproduce:
1.Preferences--->Main---> when firefox starts : show my windows and tabs from last time.
2.Login at yahoo mail or gmail.
3.Close the browser without logoout from the site

Actual Results:  
Open again firefox, you will be again in your mailbox and you can read, delete sent mail etc

Expected Results:  
To be asked again for password

At a public computer if you didnt log out there is danger a stranger have access at your yahoo mail or gmail. I try it with paypal and thanks god it asked for password

Comment 1

[chris hofmann]

In the case you mention (at a public computer) there are a variety of preference setting that are needed to ensure secure operations such as clear cache, passwords, cookies, history.  All these setting should be used.

Not security sensitive

Comment 3

[Daniel Veditz [:dveditz]]

In particular, don't use "Show my windows and tabs from last time" if you're concerned about this. Or adjust the cookie-saving level so they aren't saved at all through preferences (this will affect crash-induced recovery as well). The preference is browser.sessionstore.privacy_level and the value you want is 2 instead of the default 1. See community support links at http://www.mozilla.org/support/ for help adjusting hidden preference values.

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/browser/app/profile/firefox.js&rev=1.174&mark=540,541#530