New issue
Advanced search Search tips

Issue 601807 link

Starred by 2 users

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 3
Type: Bug



Sign in to add a comment

Sockets Not Cleared on Browser Close

Reported by sean.ba...@usuhs.edu, Apr 8 2016

Issue description

Chrome Version: 50.0.2661.67 (Official Build) beta (64-bit)
Chrome OS Version: 7978.48.0 (Official Build) beta-channel lulu
Chrome OS Platform: Dell Chromebook 13 7310
Network info: (any, multiple WiFi)

Steps To Reproduce:
(1) Open Chrome browser.
(2) Log into website with TLS client authentication.
(3) Close browser window.
(4) Open browser window; revisit site in (2).

Expected Result: User should have to reauthenticate.

Actual Result: Socket (and therefore, TLS session) has been retained, allowing the user to resume a session which was improperly terminated [by both the browser and user].

How frequently does this problem reproduce? Always.

What is the impact to the user, and is there a workaround? If so, what is
it? Only for some systems (user manually logs out; socket is terminated depending on server implementation).  But particularly in cases of federated IDM, it is possible that the user will destroy their session with the supplicant, but that the socket to the IDM / IdP will remain open, granting a new session largely transparent to the user and (IMO) in contravention of user expectation.
 

Comment 1 by dskaram@google.com, Apr 11 2016

Labels: SmartCards
Owner: dskaram@chromium.org
Status: Assigned (was: Unconfirmed)
Components: Enterprise
Owner: marcuskoehler@chromium.org
Labels: Hotlist-Enterprise-Identity
Cc: privard@chromium.org
adding privard for verification and potential fix

Sign in to add a comment