Does the browser setting to restore the previous session on startup pose any security concerns on a machine with separate logins for each user? Are there any security reasons for an organization to block that setting?
Restoring sessions means that there is a token saved in the browser that automatically logs the user in to that service.
The security issue with this is that the only thing protecting the online accounts is the device's local login. Once someone gets that, then they automatically get access to all the web services that were open. That kind of leverage is not the best.
In addition, it might be possible to obtain that token from the network and log in without access to the device.
It is better to have proper layers of protection that can be enforced:
- device login
- network login
- web services login
Each with their own sets of credentials and with expiring sessions.