I might be wrong, but I believe the request to close the browser window after logging out is common, though it's completely unclear what the risks might be of failing to close a browser window (assuming the browser is completely up-to-date) and why more importantly browsers are not able to mitigate the threat without closing the browser window. Lastly, is closing the browser better than just closing a window/tab within the browser?
After a bit of searching, it seems some banks are giving this advice following an attack on a bank that allowed users or malicious websites to reuse persistent cookies after a user had logged out, allegedly because other browser tabs were left open on the site in question and so the browser had not cleared the cookies yet.
The reason such a vulnerability would be possible indicates either of the two following security mechanisms has failed:
- The browser had not imposed a strict same-origin policy between sites, allowing a third-party site to access your bank site's cookies (OR for shared computers, you left a tab open and that tab was used by an untrusted third-party user)
- The bank website has not, or incorrectly, invalidated your cookies as it has logged you out
As far as I'm concerned, I can already conclude that this "advice" is security theater used by some websites to reject their own responsibilities onto users. Which is, obviously, very wrong as it incentivises users to waste effort and time applying silly measures instead of actually fixing the problem where it occurs.
Websites have two duties when logging a user out, according to OWASP:
- Invalidate the user state on the server's side, which will prevent any client query being replayed or crafted
- Invalidate the session cookie (as well as cookies that contain information normally accessible only to users authenticated on the website, for web apps) on the browser, to ensure no information remains available for the next user of the client browser
- Websites can even go a bit further and ensure that all open tabs on a device are refreshed on user logout. This can even remove the need for users to ensure they closed all their tabs behind them.
Thus, in a world where website developers respect their duties, there should be no basis for following such silly advice. And if websites don't, they're likely to be liable for not taking the necessary means to protect users' personal data.
You should close your web browser (to avoid private information disclosure) if...
Someone might access the computer after you do
The HTTP response (of the sensitive info) does not set the Cache-Control header properly
For example, go to yourbank.com, and look at your account. Click logout. Click the back button. Do you see your account info? On some sites you will, on others you won't, depending on that cache header.
Go to yourbank.com, and look at your account. Note the URL. Click logout. Close your browser (all windows/processes). Open your browser again with the noted URL. Do you see your account info? You should not.
The correct HTTP header is:
Cache-Control: no-store, must-revalidate
For the case where a user might have the same site open on multiple tabs (but only logs out of one), you can make the browser reload the page (thereby showing the login screen) by using the following header
Where N is the number of seconds until the user's session expires + a small buffer. It would still be vulnerable for a period, but not forever.
This advice is often given for Single Sign On (SSO) solutions. This is for a collection of systems, where a user only logs in once. The authentication of the user is handled by a central system called the Identity Provider. After login, two sessions are established with the requested system and with the Identity Provider itself. When visiting a new system the existing session with the Identity Provider is used to create a session with this new system without asking for credentials again.
Realising single log out (SLO) is a complex problem as you must invalidate sessions of each visited systems. SLO is often implemented by just giving this advice to close the browser thereby invalidating all sessions credentials.
This technique is often used when a website uses basic or windows authentication since there isn't a way to "log out". Instead of using cookies, the authentication mechanism is added as an Authorization header to every request sent to the website. For basic authentication it would be the username/password in a base64 encoded string and for windows authentication it contains values pertaining to NTLM or Kerberos auth. Thus closing the browser is the quickest and safest remediation.
This is in contrast to using forms authentication where a session can be closed by simply expiring the cookie and removing the session from the application.
It's hard to know what the banks are thinking, but there's a real benefit to closing your browser after you've logged out of a bank or another sensitive site.
Browsers aren't perfect, and are never going to be perfect. The browser memory space may contain sensitive information like usernames, passwords, tokens, account balances, etc. This SHOULD be unavailable to an attacker, but as we all know no program is completely secure. As we saw in Heartbleed, an exploit has the potential to leak that sensitive information to 3rd parties. Closing the browser and starting an entirely new process clears out the memory and removes this potential avenue for leaks.