2

Does the browser setting to restore the previous session on startup pose any security concerns on a machine with separate logins for each user? Are there any security reasons for an organization to block that setting?

1

Restoring sessions means that there is a token saved in the browser that automatically logs the user in to that service.

The security issue with this is that the only thing protecting the online accounts is the device's local login. Once someone gets that, then they automatically get access to all the web services that were open. That kind of leverage is not the best.

In addition, it might be possible to obtain that token from the network and log in without access to the device.

It is better to have proper layers of protection that can be enforced:

  • device login
  • network login
  • web services login

Each with their own sets of credentials and with expiring sessions.

  • There's nothing forcing the web token not to expire anyway, even if the browser stores it. – Nic Hartley Jul 22 at 21:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.