ASP.NET Session State shared between IE Tabs and IE8

 

One of the common problems reported with tabbed browsing in Internet Explorer is that the session state is shared between the tabs.  Sample scenario below:-

1. User A opens an IE instance and logs into a website where a session is created.

2. User A opens another tab and tries to access the same website.  Without logging in, the user is already inside the session.

3. In this case, its clear that the session is shared between the tabs.

Problems with this behavior

User retrieves a particular record in both the IE Tabs.  On one tab, the user deletes the particular record.  Parallely on the other tab, user tries to modify the record.  There will be a data instability and would throw error.

This behavior has been complained a lot.

However, imagine if it were the other way around i.e.

Sessions not shared between the tabs

Your users signed into your site and are visiting a particular page where there are a list of links (different product links).  If your users want to compare 2 products by opening them in 2 different tabs at the same time, they would have to login again for the 2 new tabs.  That would be pretty annoying since most people open multiple windows when accessing the same site.

You have a popup in your site, where you want to quickly populate some information and get back to the original site, this wouldnt work since the popup doesnt share the session.

So there are pros and cons to this behavior and people have provided workarounds to check if there is a new instance of IE (not a great approach) or set a hidden field (somewhat okay) to check if it is the same browser etc.,

The reason for this behavior is attributed to the single process that runs the tabs and hence sharing the same session state.

ASP.NET 2.0 offered a simpler solution by way of the following config setting

<sessionState mode="InProc" cookieless="UseUri"></sessionState>

This setting basically appends the Session to the URL of the browser, so your typical URL looks like http://localhost/SampleWeb/(S(afdg3ires1ik0lmjm3pkjtzl))/default.aspx    where the highlighted portion manages the session identification.

By this way, one can open multiple tabs and still have different sessions.  The only issue with this would be the absolute URLs that are hard coded, referred to, since they change with the appending of the session URI.

In IE8 each of the tabs run under a separate process.  This would make you think that the session problem gets lost (or problem is starting :))

However, by default IE8 tabs also share the session state between them to avoid lesser sessions shared within a frame process.  Once you launch IE8, there are 2 processes started – frame process and tab process.  The frame process manages the tab processes and some of the UI rendering where the tab processes does rest of the stuff - website management.  

When an additional tab is opened, there is one more tab process added and it is also managed by the same frame process which got created initially. 

If you wish to override this behavior and get a new session, you can chose “File – New Session” .  When you do this, instead of one additional process, there are 2 processes created – a frame process and tab process and these dont share session with the original frame process.

Hence, even if you are logged in to a site and have access to session, if you chose “File – New Session” and navigate to the site, it will not share the session.

If you would like to learn more on this, visit the IE Team’s blog post at IE 8 and Reliability

Cheers !!!

Print | posted on Friday, April 17, 2009 6:29 PM

Comments on this post

# Director, Microsoft .NET Development Services

Requesting Gravatar...
This problem is not new and neither is the solution. But I appreciate the post. :)
Left by Will Norton on Apr 17, 2009 8:16 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Very well Written Article. Actually, I am not an ASP developer, but I have faced this scenario many a times..and i loved the way..it is written.

Cheers'
Vijay
www.msigeek.com
Left by Vijay on Apr 17, 2009 10:48 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
The primary benefit of Tabs in a browser is simply to give users quick access to multiple browsers in a single app "window".

The expected behavior of opening another browser and visiting the same website is independent login and independent information in that browser. That should hold true for Tabbed browsing as well.

To me, sharing sessions between tabs creates more problems for the user and the developer than any benefits that can be cited for sharing the session state.
Left by Sean on Apr 18, 2009 12:28 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
I dont get this article.
My asp.net 3.5 Web application uses Forms Authentication and runs the same in IE7 and IE8 regardless of the "New Session" option mentioned in this article.

If I log-in one one IE window and open another IE window, I'm immedietaly logged into the second window the next time the second window refreshes. Then if i log-out in one window, I'm logged-out of the second window in the next refresh. I wish that it was NOT this way.
Left by Adrian on Apr 18, 2009 12:14 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
"The expected behavior of opening another browser and visiting the same website is independent login and independent information in that browser. That should hold true for Tabbed browsing as well."

I disagree. Strongly. Opening a new tab should be no different than opening a new window (ctrl-N) or a popup.
Left by gunteman on Apr 18, 2009 4:21 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
I tried to do "File-New Session" but the new browser instance still uses the session information from the existing browser instance.

Session state is not stored in the URI but in session cookie. The session cookie is set to expire after a long time. The website is built with ASP.net using .Net framework 3.5.
Here is part of config file:
<sessionState timeout="525600"/>
<authentication mode="Forms">
<forms slidingExpiration="true" timeout="525600"></forms>
</authentication>
Am I doing something wrong?
Left by Adrian on Apr 20, 2009 4:06 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Sad to hear that, does it mean we developer must write code base on IE version and use tab or not?
Left by Jack on Apr 20, 2009 7:26 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Forms authentication and session state are not related in any manner. Both use cookies (by default), but they don't share anything. Unless explicitly coded to behave differently, the session state cookie expires immediately with the browser session (hence the name "session cookie"). To make sure that forms auth cookies behave the same way, you should specify non-persistent behavior in RedirectFromLoginPage or a similar location.
Left by gunteman on Apr 21, 2009 1:00 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
IE8 Storage concept<Sessionstorage,Localstorage and Databasestorage> might be useful in handling the session id from client for each IE instance & Tab. IE8 Session issues.
Left by Gangs on Apr 22, 2009 4:14 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Is it really a problem?
Left by Aakash on Apr 23, 2009 8:01 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
I used:
<sessionState mode="InProc" cookieless="UseUri"></sessionState>

but, still when I open a new tab it uses the same session...
Left by AbulMelk on May 02, 2009 5:18 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Great post... thanks for knowledge sharing...
Left by Web 2.0 Application Development on Jun 15, 2009 5:04 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Is it really a problem?

Yes, it is. We have users that have multiple accounts in our web app, and they log in one tab, then open another tab and log in to the app again using a different account - and repeat. They open four tabs and think they are logged in to four separate accounts. They then can't understand why all the work they do in any of the tabs gets allocated to just one of the accounts - the last one they logged in to.
Left by philshort on Jun 22, 2009 5:49 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
"Is it really a problem?

Yes, it is. We have users that have multiple accounts in our web app, and they log in one tab, then open another tab and log in to the app again using a different account - and repeat. They open four tabs and think they are logged in to four separate accounts. They then can't understand why all the work they do in any of the tabs gets allocated to just one of the accounts - the last one they logged in to."

Is that not simply a bad design of the application?

Why would the user be shown a login screen when they are already logged in? Surely the app should redirect to the post login page? That would eliminate confusion of which login is being used - you would clearly see that you need to log out of one account to log into another.
Left by Zaphod on Jul 28, 2009 6:12 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
I hate this session sharing ... its causing a lot of problems to our site!!!
Left by Mukadeen on Jul 30, 2009 1:05 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
"Is it really a problem?"

Yes it is. Imagine you have a application with sensitive information. A user opens the app, loggs in. He or She opens another window doing some work or fetching flight dates for his or her next trip. Then he closes the asp.net app window but leaves the flight-ticket-window open.

Then he or she goes to the toilet.

Another colleague enters the room, takes seat and opens another window pointing to the asp.net URL and Whoppa ... is signed in automagically ... using the old session.

But this is not a IE only problem. All current browsers behave the same way. So you would have to implement a security mechanism yourself by hooking into the window close event. Or override the standard session timeout behaviour refreshing every second or two implementing a custom timer. But the problem of multiple parallel sessions remains.

So, the feature of IE 8 to open a new session is a bless. And it works.
Left by Ole on Aug 12, 2009 3:42 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
"Sessions not shared between the tabs"
i thought any window/popup opened from current browser will share the same session. in this case the new tab also will share the existing session.

Even though new tabs when not opened from the parent window does not share the session. it will share when opened from the current tab using window.open.

Left by VB Guest on Sep 19, 2009 12:01 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Quite inspiring,

thanks for this explanation, you have answered my Internete8 tab realted questions

Thanks
Left by software development london on Oct 12, 2009 9:55 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
NICE POST
THANKS A LOT... IT SOLVED MY PROBLEM :)
Left by PRITI on Oct 28, 2009 11:33 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Does anyone have a concrete solution to this problem of session sharing????
Left by rudedevil09 on Nov 04, 2009 5:03 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
I am also having same issue. I have used <sessionState mode="InProc" cookieless="UseUri"></sessionState>
My URL is http://XXX/AAA/home.aspx.
But first time i need to click twice to get
http://XXX/AAA/(S(y5oapzqkb5m3p12blyzrrg55))/home.aspx
Can you pls let me know How to solve this issue ?
Left by PS on Nov 23, 2009 12:03 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
How to solve the same issue hidden variable. Can you pls give sample or steps... It looks ugly to add / have session id in Url.
Left by PS on Nov 23, 2009 12:36 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Yes the problem resolved in IE 8 but it causes another problem in IE6 , when any user login through the LAN on the internal Web Application he login normally but if some new user login from amother machine and then the old user refresh his browser he found himself logged in using the new user account!!!
Left by Mohamed Kamal on Nov 30, 2009 1:40 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
I am also facing the same problem
Left by Anu on Dec 15, 2009 4:19 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Tabs with session shared was OK, because a new session of IE could be started with new login...

BUT with IE 8.0 it opens existing session and continues with current session, what the uuuck, this is stupid cause we can't tell if user opens new tabs versus new IE startup???????

More security issues created MS Billbos!!
Left by CoachJames on Jan 13, 2010 5:22 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
I'm copying url of the site and sending it to another user over mail or chat window but as I'm using cookieless session the same session id is getting shared with another user and so facing the problem as I don't want to use cookie to store session id. Please help me.
Left by Maddy on Jan 17, 2010 6:56 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
hi hklthlet
Left by vivek on Jan 26, 2010 10:59 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
SESSION STATE EXP
Left by Roger on Feb 11, 2010 11:03 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
veryyy gooddd
Left by meksika biberi zayiflama hapi on Jun 01, 2010 12:31 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
thanks for this great explanation, you managed to answer my Internete8 tab realted questions!
Left by Windows tips and tricks on Jun 04, 2010 9:21 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
still not resolved my problem..please help..
Left by syukur on Jul 25, 2010 4:18 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Hello,
Thanks for the post. The information is well known. I would like my session to expire on browser close button but I don't want to use URI session mode i.e. I don't want session id' to be displayed in my URL(for bookmarks etc.).
Please tell if another medium(either using javascript or something else) exists by which I can solve this problem.
Left by Manu Ram Pandit on Jul 29, 2010 6:03 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Original Post is good enough, But using such appraoch still have their own limitations; that is, Security issues,
Check out this link
http://www.developerfusion.com/article/6678/top-10-application-security-vulnerabilities-in-webconfig-files-part-one/6/

any workarround to make this secure anyway? using the same simple approach in original post for cookieless mode?
Left by Junaid on Sep 09, 2010 9:52 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
using Cookieless="UseUri" does not solve the session sharing issue. When you open two pages and refresh them, session sharing issue won't be seen. But when you do certain operation (like SAVE -- during which values are assigned and taken from session) in one form and after that do same thing in the other form, previous form's values will be copied to current form. I've been trying to solve this. It's been more than a day and still no luck...
Left by Asim Suvedi on Oct 12, 2010 9:43 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
well this information is good...but what if we use hidden field or viewstate to resolve session sharing issue? which will be better approach using hidden field or using view state?
Left by aakansha on Oct 21, 2010 5:50 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Thanks. This really helps.
Left by Mesfin on Oct 26, 2010 11:49 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Thanks for the post! It's really helpful. Any way to hide the cookie in the url?
Left by Vinod on Nov 15, 2010 4:48 PM

# Open new TAB when session timeout

Requesting Gravatar...
i'm using ASP.NET with C# code. i want to Open link in new TAB when session timeout, is it possible or not ?????????
Left by Karthikeyan on Jan 07, 2011 12:51 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Just one thing... is it really secure? showing session/cookie in the url
Left by Ravi Thapliyal on Jan 13, 2011 9:58 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Thanks. It solved my problem. Just one thing... is it really secure? showing session/cookie in the url
Left by Raj on Jan 21, 2011 11:41 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
The expected behavior of opening another browser and visiting the same website is independent login and independent information in that browser. That should hold true for Tabbed browsing as well.
Left by torrent on Feb 14, 2011 4:02 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
i am facing problem when i open my project in internet explorar or firefox in web,session value is not accepted...but when I open it in local host in any browser or google crome in web the session value is accepted... plz help me out..........
Left by anuva on Sep 02, 2011 2:00 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
But due to this behavior of IE8 the data is getting messed up in my application (as lot of seesions are used with it) and I cannot force users to not to open more than one browser instances nor can i can the whole application as it would incur high cost.Can anyone suggest how to handle that in code itself??
Left by Anonymous on Sep 27, 2011 8:31 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Please let me any updates for the same issue.
Left by Sujit on Apr 11, 2012 4:30 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Is it a problem? You betcha. We have an application where users are entering medical data. The users open multiple tabs, thinking that they are entering information for different patients, when in fact they are entereing information for one patient into another patient's record... Problem.

Solution: In Page_Load event, set a local variable and a session variable to the same value. On Postback, see if they still match, if not, redirect to either a search page, or a login page or just a page saying that the page is being used in another tab. This does not prevent users from looking at the page on one tab while entering information on the other, but it does stop them from entering information for patient a into record for patiet b.
Left by Charles Weber on Sep 21, 2012 9:47 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
thanks !!!
Left by billy on Apr 12, 2013 12:56 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Excellent article. Thank you so much.
Left by Thamarai on Jun 18, 2014 4:22 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
We have users that have multiple accounts in our web app, and they log in one tab, then open another tab and log in to the app again using a different account - and repeat. They open four tabs and think they are logged in to four separate accounts. They then can't understand why all the work they do in any of the tabs gets allocated to just one of the accounts - the last one they logged in to.
Left by santhosh on Dec 22, 2015 11:55 AM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
We have users that have multiple accounts in our web app, and they log in one tab, then open another tab and log in to the app again using a different account - and repeat. They open four tabs and think they are logged in to four separate accounts. They then can't understand why all the work they do in any of the tabs gets allocated to just one of the accounts
Left by santhosh on Dec 22, 2015 12:24 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
Even I am facing this multiple tabbing issue. Using 'useUri' in web.config is not helping in multiple tabs. In application, I am working on contains dynamic number of textboxes based on few selection criteria. Lets suppose, in one tab user selected criteria to show only 2 text boxes and at the same time in another tab they choose criteria to get 4 text boxes...so here is the problem...while user switches from one tab to another they are not able to see unique control IDs of that active tab. Both tabs use same control IDs for the text boxes and it starts throwing error while user tries to save the changes done in 2 tabs.
Left by nittin on May 02, 2016 5:44 PM

# re: ASP.NET Session State shared between IE Tabs and IE8

Requesting Gravatar...
This solution is not working in case of Web Farming or Load Balancing environment.
Left by Yogesh Sharma on Sep 22, 2017 12:50 PM

Your comment:

 (will show your gravatar)