Firefox at it again?

[Andrew Morgan]

On Wed, 24 Oct 2012, David Bantz wrote:

> My impression is that browser developers have decided that user 
> experience is enhanced if they restore "your" cookies active at the last 
> shut-down. Both Chrome and FireFox appear to do so.  As you note, this 
> makes closing the browser inadequate for session logout; in at least one 
> case at my institution caused a service to opt out of SSO as posing to 
> great a risk (i.e., of workstation user being able to use prior user's 
> session).
>
> David Bantz
> UA OIT IAM
>
> On Wed, 24 Oct 2012, at 07:44 , Russell Beall <beall at usc.edu> wrote:
>
>> My version of Firefox just went to 16.  Now it seems they have broken 
>> proper cookie handling once again.
>>
>> I cannot get my cookies to expire correctly and I have to manually 
>> delete them to kill a session now.
>>
>> This is true even though I entered the custom settings which are 
>> supposed to clear cookies as well as "Active Logins" when the browser 
>> closes.
>>
>> Seems like this may just be a bug, but I thought I'd warn people that 
>> once again the expectation of logout upon browser close is currently 
>> non-functional in Firefox.
>>
>> This is definitely an issue for us because we have to handle the kiosk 
>> and shared workstation use cases for important applications (such as a 
>> timecard system).

If you close Firefox by clicking the [X] on the window, Firefox will 
retain the "expires at end of session" cookies.  If you close Firefox by 
choosing File > Quit from the menu, Firefox will delete the "expires at 
end of session" cookies.

That's probably not much help for our typical use cases, though.

 	Andy