I have been looking through the OWASP session management cheat sheet and I don't understand the reasoning behind the suggestion to "Disable Web Browser Cross-Tab Sessions". How does using the same session id for multiple browser tabs present a security vulnerability?
It's probably under the idea that if one browser tab gets compromised, them the other browser tab may not be compromised.
This might help reduce the impact of emailed malicious links. For example, click on the link in an email to try and execute a reflected XSS vuln and you get a new tab without a session, then the link has no effect. There might be other similar vulns that this might be designed to help with, as well.
However, this appears to be is a complex solution to provide defense in depth for only part of a security flaw where the real solution is a properly architected application that uses appropriate secure frameworks (like a secure web ui framework) to prevent the issue in the first place in a far less complicated way that doesn't break normal usability of web applications.
I would guess that in principle it's because it's to prevent possibility of a Bad Person hijacking your session.
If such a person were to be tapping your session then would have your cookie (or less trivially whatever magic value in the pages is identifying your session) and then all they'd have to do is spoof your IP-address.
Of course if your session were encrypted this shouldn't be possible, but presumably this rule doesn't presume it to be the case, or rely upon it.
It's not something HTTP itself can deal with, but the rule itself notes that:
There's more on what you might specifically need to do here: https://stackoverflow.com/questions/11008177/stop-people-having-my-website-loaded-on-multiple-tabs
There are another few scenarios that come to mind.
A ticket sales site might like to do something like this to prevent their customers "gaming" a queueing system by running multiple tabs. But this is a session management issue really, because the customer is effectively running multiple "queueing sessions" within their actual session.
It can also simplify site design if you don't need to worry about race conditions between different user activities thus forcing them to do "one thing at a time", though this is more of a UX than a security issue.
Finally, this rule could also frustrate the activities of scraping software, or bots (such as those that could be used on ticket sites again for instance). This would be an effective countermeasure against an attacker logging in through the browser to capture a session, and then continuing the session with the bot.