Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In a website I'm building when I login, close FireFox, open FireFox and try to go to the website again I must login again (as expected) BUT if I select "Restore Previous Session" I am logged in again. I consider this a security threat as many users expect to be logged out after the browser is closed. I check for a valid session by

session_start();
if(isset($_SESSION['loggedIn']))

and if this is true the user is logged in.

In I.E. I wasn't able to reproduce this. How can this be fixed?

share|improve this question
1  
Here is a related post about Firefox not killing cookies between closes: stackoverflow.com/questions/777767/firefox-session-cookies –  Eric G Mar 5 '13 at 3:23
add comment

4 Answers

up vote 5 down vote accepted

Set PHP's session.cookie_lifetime=0. With a value of zero the session token will be destroyed when the browser closes. session.gc_maxlifetime will still destroy the session after a period of time.

share|improve this answer
    
It's already set. session.cookie_lifetime=0 :( –  Celeritas Mar 5 '13 at 22:13
    
@Celeritas then you are probably not using session_start() or you have done something else strange to your session handler. –  Rook Mar 5 '13 at 23:17
    
I used phpinfo() to check and it has "session.cookie_lifetime 0 0" I'll double check the code but I'm starting to get worried. –  Celeritas Mar 6 '13 at 0:14
    
@Celeritas these values can also be set at runtime. –  Rook Mar 6 '13 at 2:58
add comment

This a long standing security bug of Firefox which is at least around since 2008. For example see https://bugzilla.mozilla.org/show_bug.cgi?id=443354#c48 ("Save and Quit tabs should not save session cookies of to-be-restored tabs").

Further details and a workaround are also described at https://support.mozilla.org/de/questions/938865 in "Firefox doesn't delete cookies on exit. When will it do?".

The workaround uses about:config to set

  • browser.sessionstore.privacy_level = 1 or 2
  • browser.sessionstore.privacy_level_deferred = 1 or 2

as described in comment 48 of the bug report above.

share|improve this answer
add comment

It's not a bug, it's a feature.

Firefox' session restore feature, as its name says, is supposed to… restore my session. The whole session. Including the state of tabs, their form data… Everything. And this is great. This is the goal of session restore.

Mac OS X Mountain Lion's applications are now stateful, like on the iPad. The apps now have their state saved at quit and restored at relaunch. This behaviour of Mac applications is now recommended by Apple's guidelines for developers.

Computer systems will behave more and more like this, and this is a good move. Better get used to it. This can be somewhat disturbing at the beginning, because of our habits. But for newcomers, it is more natural. It is always a good idea to think of the paper analogy. Let's say I am writing in my notebook, I am in the middle of a sentence, and I suddenly close my notebook and I sleep. Without doing any “Save” action, without even thinking of a “Save” action. Three days later, when I open again my notebook, I find the page exactly as I had left it. This user experience is good. In computer software, the same user experience is good too, and I expect it.

share|improve this answer
    
But I.E. has "Reopen last browsing session" and it doesn't seem to remember logged in sessions. –  Celeritas Mar 4 '13 at 21:53
1  
So you're saying it's not good to have a user enter their password more than once and to always keep the session on the browser/computer? –  Celeritas Mar 4 '13 at 22:09
1  
Depends what you mean by good for security or good for usability. This is an area where they conflict. –  Rory Alsop Mar 4 '13 at 23:28
    
@Celeritas — When I check a box named Remember, I want the site to… remember. As always, security harms usability and usability harms security. So in fine the right thing to do depends on the situation and on the user's choice. Is the system the entry control of a CIA bunker or a daily life Web site ? Does the user trust his own computer in his own house ? It is good to let the user make his/her informed choice and to respect it. Hence the Remember check box, and the security explanation next to it. Thus, if the user is in a fragile situation, s/he can choose not to be remembered. –  Nicolas Barbulesco Mar 5 '13 at 14:33
    
@NicolasBarbulesco exactly. If the "remember me" check box is not checked then the session will still be remembered in Firefox. –  Celeritas Mar 5 '13 at 17:44
show 2 more comments

Does this happen if you set FireFox to destroy all cookies on exit? There are some addons out there that will help you get better control of cookies and when to destroy. This may help ensure the cookies are destroyed in between launches.

I am not sure if any of the FireFox Privacy Settings will do this built-in without an addon.

share|improve this answer
    
I logged in to the site, closed and reopened FireFox, then deleted the individual cookies associated with the site. When I navigated back to the site it said I wasn't logged in - so that's expected. –  Celeritas Mar 5 '13 at 17:57
    
I haven't gone through all the addons available, but I think one or two of them has an option to delete all cookies when you close the window or maybe even tab. If not, it may be possible to write such an extension. Though, for your own app if you can stop at the server side that would be best I would think. –  Eric G Mar 5 '13 at 19:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.