1

SharePoint 2013 doesn't use Session cookies by default, but rather persistent cookies. Based on several articles, including this one, you can force SharePoint to use session cookies by the following PowerShell command. I ran this command in my SharePoint environment.

$sts = Get-SPSecurityTokenServiceConfig
$sts.UseSessionCookies = $true
$sts.Update()

My goal is to make a user re-authenticate when they close and re-open their browser. For both Forms Authenticated users and Windows Authenticated users, this works great in Firefox and IE. However, in Google Chrome, when I close/re-open the browser and navigate to my SharePoint site, it remembers the user that I was authenticated as before I closed my browser; which is baffling, considering this is supposed to be a Session cookie. This happens for both Forms Authenticated users, and Windows authenticated users.

FedAuth Session cookie, given by SharePoint, as seen in Chrome SharePoint session cookie, as seen in Chrome

Any ideas why Google Chrome (but not IE or FF) is "remembering" my credentials upon browser close/open?

SharePoint Version: 2013, on-premise. Chrome Version: 42.0.2311.152

Other Notes:

  • WindowsTokenLifetime is set to it's default value, 10hrs
  • FormsTokenLifetime is set to 2 minutes
  • LogonTokenCacheExpirationWindow is set to 1 minute

Update: I tried closing all identifiable Chrome.exe processes via Taskmgr, but the next time I opened my browser, it still remembered me. However, I restarted my computer, opened the browser, and it didn't remember me that time. I don't think this is a SharePoint issue, but rather a Chrome issue. My guess is that some Chrome process is staying alive somewhere, even though it appears to be closed, thus allowing the "Session" to remain open. Still investigating...

contactmatt
  • 18,116
  • 40
  • 128
  • 186

1 Answers1

0

Apparently, when you let Chrome run in the background, the Session cookies aren't expired (even though you've closed the browser). Disabling background mode causes Chrome to forget your Session cookie, as it should.

enter image description here

Note: I'm curious if this a bug in Chrome. This behavior seems to go against what a Session cookie is.

a cookie that is erased when the user closes the Web browser. The session cookie is stored in temporary memory and is not retained after the browser is closed

Update: According to Google, this is expected behavior (though I'd consider that notion debatable). Also, another SO user also came across the same issue.

Community
  • 1
  • 1
contactmatt
  • 18,116
  • 40
  • 128
  • 186