Google Chrome keeps session variables after browser close

asp.net security google-chrome session-state
done_merson picture done_merson · Jul 27, 2012 · Viewed 7.1k times · Source

I am using asp.net forms version 4 and using the built in FormsAuthentication. I have selected to not persist the User.

      FormsAuthentication.RedirectFromLoginPage(userIAmUsing, false);

When I close the browser in IE and Firefox. My session variables are destroyed and I am asked to re-login when I return to the page. However, in my Chrome settings I have the "Continue where I left off" setting checked. When I close the browser in Chrome, it is persisting the cookie against my (the developer's) wishes. In fact, even after I have logged out of my machine, the session is persisted. That being the situation, does anyone know of any thing that I can do as a developer to override this behavior and not allow the session to persist after browser close? In other words, can I make Chrome behave exactly like other browsers even if the user has checked that setting?

Answer

Jeff picture Jeff · Jul 27, 2012

Cookies and sessions both have timeouts. You can set the timeouts to be short so Chrome wont try to reuse them after their time is up.

Related questions

What are all the user accounts for IIS/ASP.NET and how do they differ?

Under Windows Server 2008 with ASP.NET 4.0 installed there is a whole slew of related user accounts, and I can't understand which one is which, how to they differ, and which one is REALLY the one that my app runs under. …

Read More
X-Frame-Options Allow-From multiple domains

I have an ASP.NET 4.0 IIS7.5 site which I need secured using the X-Frame-Options header. I also need to enable my site pages to be iframed from my same domain as well as from my facebook app. Currently I have …

Read More
ASP.NET Identity's default Password Hasher - How does it work and is it secure?

I am wondering wether the Password Hasher that is default implemented in the UserManager that comes with MVC 5 and ASP.NET Identity Framework, is secure enough? And if so, if you could explain to me how it works? IPasswordHasher interface …

Read More