IE 8 Release version is sharing session cookies across browsers

Referrers IP address.

Regards.
"jdaigle" <jdaigle.3qaks1@no-mx.forums.vistaheads.com> wrote in message
news:jdaigle.3qaks1@no-mx.forums.vistaheads.com...
>
> EricLaw/PA Bear,
> I can validate what version of a browser the end user of our app is
> running, is there any way to also validate that, if it is IE8, the IE8
> window was opened with -NoMerge option? or another way to ensure it has
> its own unique session, not linked to any other existing IE windows.
>
> thanks,
> Jeremiah
>
> 'PA Bear [MS MVP Wrote:
>> ;1207117']~waves & thanx @EricLaw~
>>
>> EricLaw wrote:
>> > This behavior is by-design for IE8. We elected to make session
>> > handling more consistent. Previously, some entry points would create
>> > a new session (e.g. clicking a desktop icon) while others did not
>> > (e.g. File > New Window).
>> >
>> > There's a little test page that makes this easy to demo here:
>> > 'Browser Session Test' (http://www.enhanceie.com/test/sessions/)
>> >
>> > Now in IE8, new sessions are created explicitly, by clicking File >
>> > New Session, or by starting iexplore.exe with the -nomerge command
>> > line parameter.
>> >
>> > I'll be putting up a post on this topic on the IEBlog
>> (blogs.msdn.com/
>> > ie) shortly.
>> >
>> > Thanks,
>> >
>> > Eric Lawrence
>> > Security Program Manager
>> > Internet Explorer
>> >
>> > On Mar 23, 5:06 am, Steve H <Ste...@discussions.microsoft.com> wrote:
>> >> Hi,
>> >>
>> >> We've got a big problem with IE 8.
>> >>
>> >> With IE 7 you could launch different browser sessions and login to a
>> web
>> >> site with different ID's. Each browser window would have it's own
>> session
>> >> cookie. Each tab would share the session cookie - which is exactly
>> how it
>> >> should intuitively work.
>> >>
>> >> If you do this with IE 8 then there seems to be only ever one
>> session. No
>> >> matter how many browsers you open you get the same session and so
>> you can
>> >> login as only one user at a time.
>> >>
>> >> This is a problem for us with our own application, but it is also a
>> >> problem
>> >> with all web sites and we have reproduced it with Ebay for example.
>> >>
>> >> I haven't been able to find any settings in the UI to disable this.
>> >>
>> >> Best regards
>> >>
>> >> Steve
>
>
> --
> jdaigle
> Posted via http://www.vistaheads.com
>

[jdaigle]

Not sure what you are talking about, could you clarify?
thanks,
Jeremiah

Quote:

Originally Posted by Rob ^_^

Referrers IP address.

Regards.


>
> EricLaw/PA Bear,
> I can validate what version of a browser the end user of our app is
> running, is there any way to also validate that, if it is IE8, the IE8
> window was opened with -NoMerge option? or another way to ensure it has
> its own unique session, not linked to any other existing IE windows.
>
> thanks,
> Jeremiah
>
> 'PA Bear [MS MVP Wrote:
>> ;1207117']~waves & thanx @EricLaw~
>>
>> EricLaw wrote:
>> > This behavior is by-design for IE8. We elected to make session
>> > handling more consistent. Previously, some entry points would create
>> > a new session (e.g. clicking a desktop icon) while others did not
>> > (e.g. File > New Window).
>> >
>> > There's a little test page that makes this easy to demo here:
>> > 'Browser Session Test' (Browser Session Test)
>> >
>> > Now in IE8, new sessions are created explicitly, by clicking File >
>> > New Session, or by starting iexplore.exe with the -nomerge command
>> > line parameter.
>> >
>> > I'll be putting up a post on this topic on the IEBlog
>> (blogs.msdn.com/
>> > ie) shortly.
>> >
>> > Thanks,
>> >
>> > Eric Lawrence
>> > Security Program Manager
>> > Internet Explorer
>> >
>> > On Mar 23, 5:06 am, Steve H <Ste...@discussions.microsoft.com> wrote:
>> >> Hi,
>> >>
>> >> We've got a big problem with IE 8.
>> >>
>> >> With IE 7 you could launch different browser sessions and login to a
>> web
>> >> site with different ID's. Each browser window would have it's own
>> session
>> >> cookie. Each tab would share the session cookie - which is exactly
>> how it
>> >> should intuitively work.
>> >>
>> >> If you do this with IE 8 then there seems to be only ever one
>> session. No
>> >> matter how many browsers you open you get the same session and so
>> you can
>> >> login as only one user at a time.
>> >>
>> >> This is a problem for us with our own application, but it is also a
>> >> problem
>> >> with all web sites and we have reproduced it with Ebay for example.
>> >>
>> >> I haven't been able to find any settings in the UI to disable this.
>> >>
>> >> Best regards
>> >>
>> >> Steve
>
>
> --
> jdaigle
> Posted via http://www.vistaheads.com
>

Each request to a server has a referrer.

Store sessionID's and IP address pairs on session start. Remove them on
session end.
On session start check if the IP address of the referrer already has a
session ID. Send them back a message page of such if that is your intent.
(One session per PC/Workstation)
"jdaigle" <jdaigle.3qank7@no-mx.forums.vistaheads.com> wrote in message
news:jdaigle.3qank7@no-mx.forums.vistaheads.com...
>
> Not sure what you are talking about, could you clarify?
> thanks,
> Jeremiah
>
>
> Rob ^_^;1218538 Wrote:
>>
>>
>> Referrers IP address.
>>
>> Regards.
>>
>>
>> >
>> > EricLaw/PA Bear,
>> > I can validate what version of a browser the end user of our app is
>> > running, is there any way to also validate that, if it is IE8, the
>> IE8
>> > window was opened with -NoMerge option? or another way to ensure it
>> has
>> > its own unique session, not linked to any other existing IE windows.
>> >
>> > thanks,
>> > Jeremiah
>> >
>> > 'PA Bear [MS MVP Wrote:
>> >> ;1207117']~waves & thanx @EricLaw~
>> >>
>> >> EricLaw wrote:
>> >> > This behavior is by-design for IE8. We elected to make session
>> >> > handling more consistent. Previously, some entry points would
>> create
>> >> > a new session (e.g. clicking a desktop icon) while others did not
>> >> > (e.g. File > New Window).
>> >> >
>> >> > There's a little test page that makes this easy to demo here:
>> >> > 'Browser Session Test' ('Browser Session Test'
>> (http://www.enhanceie.com/test/sessions/))
>> >> >
>> >> > Now in IE8, new sessions are created explicitly, by clicking File
>> >
>> >> > New Session, or by starting iexplore.exe with the -nomerge command
>> >> > line parameter.
>> >> >
>> >> > I'll be putting up a post on this topic on the IEBlog
>> >> (blogs.msdn.com/
>> >> > ie) shortly.
>> >> >
>> >> > Thanks,
>> >> >
>> >> > Eric Lawrence
>> >> > Security Program Manager
>> >> > Internet Explorer
>> >> >
>> >> > On Mar 23, 5:06 am, Steve H <Ste...@discussions.microsoft.com>
>> wrote:
>> >> >> Hi,
>> >> >>
>> >> >> We've got a big problem with IE 8.
>> >> >>
>> >> >> With IE 7 you could launch different browser sessions and login
>> to a
>> >> web
>> >> >> site with different ID's. Each browser window would have it's own
>> >> session
>> >> >> cookie. Each tab would share the session cookie - which is
>> exactly
>> >> how it
>> >> >> should intuitively work.
>> >> >>
>> >> >> If you do this with IE 8 then there seems to be only ever one
>> >> session. No
>> >> >> matter how many browsers you open you get the same session and so
>> >> you can
>> >> >> login as only one user at a time.
>> >> >>
>> >> >> This is a problem for us with our own application, but it is also
>> a
>> >> >> problem
>> >> >> with all web sites and we have reproduced it with Ebay for
>> example.
>> >> >>
>> >> >> I haven't been able to find any settings in the UI to disable
>> this.
>> >> >>
>> >> >> Best regards
>> >> >>
>> >> >> Steve
>> >
>> >
>> > --
>> > jdaigle
>> > Posted via http://www.vistaheads.com
>> >
>
>
> --
> jdaigle
> Posted via http://www.vistaheads.com
>

[KingAragorn]

>> EricLaw wrote:
> > This behavior is by-design for IE8. We elected to make session
> > handling more consistent. Previously, some entry points would[/color]
>> create
> > a new session (e.g. clicking a desktop icon) while others did not
> > (e.g. File > New Window).

> > There's a little test page that makes this easy to demo here:
> > 'Browser Session Test' ('Browser Session Test'
>> (Browser Session Test))[color=darkred]
> >
> > Now in IE8, new sessions are created explicitly, by clicking File
>> >
> > New Session, or by starting iexplore.exe with the -nomerge command
> > line parameter.
> >
> > I'll be putting up a post on this topic on the IEBlog
> (blogs.msdn.com/ie) shortly.

> > Thanks,

> > Eric Lawrence
> > Security Program Manager
> > Internet Explorer

Eric

I recently tried your test page and found inconsistent behaviour when using the File > New Session. Whilst it worked correctly for a few color changes eventually window 1 was affected by changes in window 2 (The window opened using File>New Session)

The only way I have found so far is to create a new session is to use a In Private session.

Peter Thiele