I work with sensitive sites that handle financial information, my code protects more than four billion pounds of assets.
All of our sites have a logout button and in addition use HttpOnly, Secure, Session cookies to maintain a user's session. Although we expect users to click the "Logout" button, we also anticipate that some users will not do this; as a result, we rely on the session cookies to be dropped when the user closes the browser.
Recently it has come to my attention that browsers don't always drop session cookies when you close them. Chrome, specifically, has a "Resume where I left off" feature that persists session cookies after the browser is closed, and what's more this option is selected by default. FireFox has a similar feature.
What additional mitigations have you implemented due to this feature? We considered a few:
OnBeforeUnload/Unload/PageHide handler to drop cookies when the window is closed. Unfortunately you can't drop HttpOnly cookies in this manner.
AJAX handlers to maintain a heartbeat with the server. Again, this will not work when the tab is inactive.
Is any additional mitigation necessary? Or is it buyer beware if you don't explicitly logout? Curious what other IT professionals have done about it.
Note: We also use a persistent cookie with a ten-minute sliding window, and expire the session on the server side in ten minutes. The point of this exercise is to mitigate malicious activity that occurs within the 10 minute window, e.g. if someone is watching you carefully in an internet cafe and takes over your workstation if you don't log out properly.