Sockets Not Cleared on Browser Close
Reported by
sean.ba...@usuhs.edu,
Apr 8 2016
|
|||||
Issue descriptionChrome Version: 50.0.2661.67 (Official Build) beta (64-bit) Chrome OS Version: 7978.48.0 (Official Build) beta-channel lulu Chrome OS Platform: Dell Chromebook 13 7310 Network info: (any, multiple WiFi) Steps To Reproduce: (1) Open Chrome browser. (2) Log into website with TLS client authentication. (3) Close browser window. (4) Open browser window; revisit site in (2). Expected Result: User should have to reauthenticate. Actual Result: Socket (and therefore, TLS session) has been retained, allowing the user to resume a session which was improperly terminated [by both the browser and user]. How frequently does this problem reproduce? Always. What is the impact to the user, and is there a workaround? If so, what is it? Only for some systems (user manually logs out; socket is terminated depending on server implementation). But particularly in cases of federated IDM, it is possible that the user will destroy their session with the supplicant, but that the socket to the IDM / IdP will remain open, granting a new session largely transparent to the user and (IMO) in contravention of user expectation.
,
Dec 27 2017
,
Aug 23
,
Sep 18
,
Nov 2
adding privard for verification and potential fix |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by dskaram@google.com
, Apr 11 2016Owner: dskaram@chromium.org
Status: Assigned (was: Unconfirmed)