Session management within Internet Explorer 8.0

  • Article

Hi everyone!

Veena again, back with a discussion on session management in IE8. Many application developers expect that they lose their session when they close the IE window. So when the user launches a new instance of IE, they expect that the user is shown the login screen. However, to their surprise, this doesn’t happen automatically with IE8. IE8 is actually behaving as expected and I will attempt to explain why.

Relying on closing the window to clear the session is not a recommended way to implement proper logoff for an application. Because this clearly will not work if there is another window that is sharing the session. This has been the behavior always although our mechanics for which windows share a session has changed in IE8. For example, in IE6 and IE7, there were several ways to launch new windows, some of which gave you a new session, others of which did not.

Click IE shortcut from desktop, start->run -> New Session

  • Run iexplore.exe -> New Session
  • Click File->New Window -> Same session
  • Click “Open link in new tab” (IE7) -> Same session
  • Click “Open link in new window” ->  Same session
  • Window.open() ->  Same session

As you can see, even in IE7, closing the browser window does not guarantee that your session and credentials would be destroyed.  As you may already be aware, many architectural changes were put into IE8. One such change, was to unify the session model and improve performance.  For More information please review MSDN IE Blog Title: IE8 and Reliability - https://blogs.msdn.com/b/ie/archive/2008/07/28/ie8-and-reliability.aspx.

So what if I want the old behavior back?  Well, there are three ways available:

  • Registry key
    HKCU\Software\Microsoft\Internet Explorer\Main\FrameMerging
    0 - disable frame merging
  • Command-line switch : If the application is being launched via a desktop shortcut, the command line switch “-noframemerging” could be added to that to get the desired effect.
    • Example: "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -noframemerging
  • Menu item (“File->New Session”)

In summary, having the user close the browser window has never been sufficient to ensure that the session is destroyed. If the user had another window open in the same session, then that window would still effectively be logged in. However, if the user clicks “Log off” in the application before closing the window, the application CAN clear any credentials in the session, either by deleting session cookies (if that’s the authentication mechanism), or by deleting all of the credentials in the session via document.execCommand(ClearAuthenticationCache, false). If the application code does this, the user will not need to close the window to complete the logging out process. So next time they browse to it in another window that’s sharing the session, they should see the login screen as expected.

For more information on Frame Merging, click here.

Regards,

The IE Support Team

Comments

  • Anonymous
    May 08, 2009
    How do I resolve this problem in my application. I have a registration form written in php. What do I include in my code so that when visitor closes the browser in IE8, it kils the session.

  • Anonymous
    July 21, 2009
    Is it possible to invoke a java script (or similar action) to force the client to take the same action as "File -> New Session"? If so, could you detail how this would be done?

  • Anonymous
    July 21, 2009
    HiThe above given Registry key does not exist in my windows XP version.Any comments on that?

  • Anonymous
    August 26, 2009
    Same here, FrameMerging reg enty doesnt exist in XP. how do you resolve this issue in xp.

  • Anonymous
    January 06, 2010
    Frame merging is enabled by default in IE8. You add the following registry key  to disable frame mergingHKCUSoftwareMicrosoftInternet ExplorerMainFrameMerging0 (DWORD)

  • Anonymous
    February 16, 2010
    I cannot find FrameMerging key in registry. Where is it?Windows XP Prof SP 3IE 8.0.6001.18720CODidn't find HKCUSoftwareMicrosoftInternet ExplorerMainFrameMergingPlease help. I need to open up new window without automatically logging in with same session.

  • Anonymous
    March 02, 2010
    This has been incredibly frustrating.What have others been informing users in terms of dealing with this issue?

  • Anonymous
    March 05, 2010
    Wonderful information! I was just reviewing a session problem with IE8 and this is a partial solution. Thanks a bunch!

  • Anonymous
    April 12, 2010
    If two windows shave a session and one is closed then, no don't close the session. If all instances close then yes the session closes.Secure session cookies rely on this behaviour.The expected user behaviour, whether you like it or not, is that closing a browser closes a login. Putting a logout button is zero gaurentee that the user will click it. You can engineer code, but you can't engineer your users.This is a bug.

  • Anonymous
    April 20, 2010
    "Relying on closing the window to clear the session is not a recommended way to implement proper logoff for an application. Because this clearly will not work if there is another window that is sharing the session. "True, buy why, pray say, session isn't cleared for one application if I close its window, but keep another window, pointing to a completely different application, on different server in different DOMAIN?!Do try this: Login to any app that that require login and keep user's info in session. Open a new browser, and point it anywhere completely unrelated (link to this article will do). Close original app window. Open new browser window and go to that app URL. Surprise, surprise, you're still logged on."Relying on closing the window to clear the session is not a recommended way to implement proper logoff for an application"Are you aware that 99.9% of all users will simple close browser window instad of going thru logout process even if it takes only one click?  And in many scenarious, including one above - they will stay logged in.

  • Anonymous
    June 23, 2010
    Is there a method to code around this or a setting in web services? My enterprise folks want to allow this but I don't because of the way my applications act.

  • Anonymous
    July 06, 2010
    Hi,Can we call the following JS function in body's Onbeforeunload  event?function handleUnload()       {

            if((window.event.clientX < 0) || (window.event.clientY < 0))        { //if close window            document.location = "Logout.asp"
               }       }and clear all session cookies information?It works as expected. but will there be any issues?The above JS only tested for IE browserRegards,Visu

  • Anonymous
    September 30, 2010
    Is it possible to have a web page that programmatically links to another website while ensuring a new browser session is spawned?

  • Anonymous
    February 08, 2011
    window.open with a window name should target the same window always.But on IE8 with File - New Session it ignores the target window name and opens a newwindow. Why its not opening in the same window. eg. window.open("http://www.google.com","win");

  • Anonymous
    March 01, 2011
    Hey JB,Go to HKEY_CURRENTUSERSoftwareMicrosoftInternet ExplorerMainThen right click on the folder "Main" and go to New, then DWORD. Call it FrameMerging and make sure the value is set to 0.

  • Anonymous
    March 16, 2011
    is it not possible to use the old way of untick reuse windows for launching Shortcuts(when tabbed browsing is off)

  • Anonymous
    May 03, 2011
    Adding 'FrameMerging' key does not work when I launch the page from 'Frequent List' in windows 7, anyone has solution to it.

  • Anonymous
    May 16, 2011
    Is it possible to invoke a java script (or similar action) to force the client to take the same action as "File -> New Session"? If so, could you detail how this would be done?

  • Anonymous
    May 25, 2011
    Hi,I am facing one problem in my project. The scenario is, I have 2 different applications which are running on the same host and webserver but on diffrenet application servers. The problem is that when I logoff from one application, automatically the other also getting signed out. And to my wonder this is happening only with IE8. All the below versions dont have any issues..Can anyone out here help me in this regard??

  • Anonymous
    August 08, 2011
    Hi there, hope someone can help.  I'm having a siteminder issue with IE8.  I use multiple sites simultaneously that require my credentials & with IE8, I am automatically logged off of one site the second I open up another tab that requires a log in.  I was able to use the command "-noframemerging" to help avoid this issue when using seperate Windows, but I would like to keep one window open & utilize the Tabs instead.  It's much easier when needing 5+ sites open at once to just use tabs but unfortunatley with this issue, I can't unless I want to log in to each site EVERY time I switch back & forth between tabs.  Please help!

  • Anonymous
    October 02, 2011
    using IE8 and win 7tried to have 2 instances of hotmail open 1 for me and one for my partner, she wanted to chech her mail and i was in the middle of composing a long mail application.however everytime we logged into one instance we were logged out the other.we even tried this on facebook but again we were logged out one account when we logged into the other.have tried clearing cookies and temp files but this has had no effect still getting logged out,any one any ideas?

  • Anonymous
    January 26, 2012
    I've tried all of your examples above, but I cannot get "Run iexplore.exe -> New Session" to create session.  After opening 2 windows, go to the Tools  | Developer Tools (F12).  Then click on the Cache | View Cookie Information, then search for the JSESSIONID, you will find that they are the same (at least they are for me).  I'm not sure how to work around this, my clients want to be able to edit in two different sessions.

  • Anonymous
    February 07, 2012
    Please review blogs.msdn.com/.../ie8-and-reliability.aspx for more information about the changes.

  • Anonymous
    June 06, 2012
    dears FrameMerging doesn't work with IE8 in our PCs,I have windowsXPSP3 and Windows7 SP1 and I'm getting the same so please anyone has solution to help as all options from microsoft don't work with opening segregate sessions or what we call it no framemerg

  • Anonymous
    June 07, 2012
    @osa1980 - Did you try the commnad switch?Exmaple: "C:Program Files (x86)Internet Exploreriexplore.exe" -noframemerging

  • Anonymous
    March 27, 2013
    On XP or WIN7, What I have experienced is as follows.File > New Sesion or  iexplore.exe -nomerge blogs.msdn.com/.../session-cookies-sessionstorage-and-ie8.aspxIf you open  an application in IE session, one that authenticates the user id in the session. Then, try to launch a URL survey from same application (clicking with mouse) which uses a different id, the URL fails, because an existing user is already logged in. If you open a an application is IE session one that authenticates the user id is session. Then File>New Session - Then, try to launch a URL survey from same application (clicking with mouse) which uses a different id, the URL fails, because the clicking of the mouse (os ) is looking for the 1st session opened.  If you open a an application is IE session one that authenticates the user id is session. Then File>New Seesion - Then, try to launch a URL survey from same application (by copy paste), works.  If you open 2 new session, and in second session - open a an application is IE session one that authenticates the user id is session. Then, try to launch a URL survey from same application (clicking with mouse) which uses a different id, the URL works, because the clicking of the mouse (os ) is looking for the 1st session opened. What is the work around, to have the clicking on URL , start is the last session openned?

  • Anonymous
    December 07, 2014
    Hi, Can anyone please help me on this issue ??Am not able to open "New Session" in Internet explorer 32-bit. But i can open in 64 bit IE.Kindly give me any fix. Thanks.

  • Anonymous
    December 11, 2014
    I'm having the same issue as Sathish.  

  • Anonymous
    December 26, 2014
    Try using the -private (in private) and noframemerging switches from a shortcut.Right Click on your Desktop and select New / Shortcut / Browse to:C:Program Files (x86)Internet Exploreriexplore.exe click on Next Give it a name, like Private / Nosession Finish Right click on the shortcut Select property Add the following switches at the end: -private -noframemerging  -  It should look like this:  "C:Program Files (x86)Internet Exploreriexplore.exe" -private -noframemerging Whenever you want to login using multiple user for the same mail provided, like Hotmail, use the shortcut.