Registered said:
Yes it does happen. There can be problems with a single user and
multiple browsers pointing at the same web app. The big issue occurs
when the user logs out in one browser and expects the other browser
instances to be unaffected.
The problem is one user leaves the browser open without signing out so
that anyone with access to the machine has access to the existing
session by either opening a new browser and pointing to the app or
using the existing browser instance.
If the second user uses the browser instance left open by the first
user, what protects the first user's data from being viewed or
altered?
Perhaps I'm misreading this but it doesn't make a lot of sense.
Multiple browser instances on a single machine pointing at a single
web application share the session. TMK the network itself has no
impact WRT a browser's inherent behavior. Session data can be
persisted when a session expires but this has nothing to do with
sticky sessions.
But it has everything to do with an application that uses SESSION
VARIABLES. I gave you two examples.
One was with sticky sessions that has no timeouts and is to bring back
everything if the user has left for hours or days even and came back to
that workstation logged back into the workstation and picked up and
started working in the session as if nothing never happened.
And one was given using session variables that cannot loose session
variable data if it times out, it must bring back everything intact and
he or she can be gone for hours or days, expecting to resume a session
as if nothing had happened.
There are a mixture of these application running on the front-end Web
servers using .NET and classic ASP solutions.
The described problem isn't with a single user and multiple browsers.
The solution you have provided assumes the second user will log in
through a new browser instance rather than just use the instance that
someone else has left open. There is no programmatic protection
against the latter.
They only login in onetime and that's it, and that same user can start
another browser session within the established session and no login is
needed as he or she is already logged into the workstation and the
network through the portal.
No other user comes to his or her machine and does anything on a DoD
network, that requires a individual CAT card for authentication to
access the network or access the machine. It doesn't happen.
In an environment where multiple users share the same computer it is
imperative that each individual take the necessary precautions to
protect their data from other users. Failure to do so is an invitation
for some form of malfeasance to occur.
This is a DoD network a closed network, and it doesn't happen that a
user can walk-up and use another user's workstation.
I have worked in environments large corporations where they do look for
infractions, have back doors on the machine, like a workstation, and
they are on someone like a hawk always looking for infractions.
So no in some cases, no one just gets up and walks away from that
machine without locking it out on a coffee break.
Security is only an illusion if the user walks away from the machine
leaving the application open and their CAT card in place.
It don't happen on a DoD network that has secret and top secret data
flying around on the network. They are very aware of what is going on,
very aware of the user, and the user is very aware of the ramifications
of a user not following security protocols.
I can't even leave the country on vacation without getting a security
clearance to leave the county with full travel itinerary given.
There is no illusion of security with fine, imprisonment or both.
I don't see you sitting there in the cubical next to me. <smile>
