如何防止所有 Firefox 浏览器实例使用相同的身份验证 cookie？
我通过创建 Default.aspx 和名为 login.aspx 的自定义登录页面来实现表单身份验证。 如果未经身份验证的用户浏览到 Default.aspx，他们将被重定向到 login.aspx，并且只有在提供的凭据找到匹配项时，用户才会被重定向到 default .aspx。
但是当使用 Firefox 时，似乎所有浏览器实例都使用相同的身份验证 cookie 实例，因此如果浏览器 B1 中的用户以用户 U1 身份登录，则访问该 Web 应用程序的所有浏览器实例都将以用户 U1 身份登录。 因此，如果浏览器实例 B1 第一次请求 Default.aspx，它将立即被授予访问权限。
如果我以用户 U1 身份登录后，浏览到
login.aspx并使用不同的用户名（例如用户 U2）登录，则回发所有浏览器（之前以用户 U1 身份登录） ) 现在将以用户 U2 的身份登录。
如何防止这种行为，以便每个浏览器实例都能收到自己的身份验证 cookie？
I implemented Forms authentication by creating Default.aspx and custom login page named login.aspx. If unauthenticated users brows to Default.aspx, they are redirected to login.aspx, and only if match is found for the supplied credentials, is user redirected to default.aspx.
But when using Firefox, it appears all browser instances use the same authentication cookie instance, and thus if user in browser B1 logs in as user U1, then all browser instances visiting that web application will be logged in as user U1. So if for example browser instance B1 requests Default.aspx for the first time, it will immediately be granted access.
If, after I logged in as user U1, I surf to
login.aspxand log in using different username (say user U2), then on postbacks all browser(previously logged in as user U1) will now be logged in as user U2.
How can I prevent this sort of behavior so that each browser instance would receive its own authentication cookie?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
每个浏览器实例都有自己的一组 cookie。 还有历史。 还有书签。 因为每个正在运行的实例都需要附加到其自己的配置文件。
但是，任何给定实例都可以打开多个选项卡和窗口。 这些将共享 cookie。 如果这对您不起作用，那么就不要使用 cookie...
如果您只是想让测试变得更容易，为什么不设置一个单独的测试配置文件并启动附加到该配置文件的单独的 Firefox 实例呢？
Each browser instance will have its own set of cookies. And history. And bookmarks. Because each running instance will need to be attached to its own profile.
Any given instance can have multiple tabs and windows open however. And those will share cookies. If that doesn't work for you, then don't use cookies...
If you just want this to make testing easier, why not set up a separate testing profile and launch a separate instance of Firefox attached to that?
一个快速的实验向我展示了 Shog9 的含义。 启动火狐浏览器。 然后启动另一个 Firefox“实例”。 然后查看任务管理器，您将看到只有一个 firefox.exe 进程在运行。
我猜他的意思是你从未真正见过 Firefox 的两个实例。 您只见过同一实例运行两个窗口。 当然，它们共享相同的 cookie。
我认为这意味着为了真正拥有单独的实例，它们必须在单独的登录名或用户配置文件下运行，并且它们将具有单独的 cookie 集。
编辑：有关 FireFox 中配置文件的一些资源：
A quick experiment showed me what Shog9 is implying. Start Firefox. Then start another "instance" of Firefox. Then look in Task Manager, and you'll see that you only have a single firefox.exe process running.
I presume he means that you have never actually seen two instances of Firefox. You've only seen the same instance running two windows. Naturally, those share the same cookies.
I presume this implies that in order to actually have separate instances, they'll have to run under separate logins or perhaps user profiles, and they will have separate sets of cookies.
EDIT: some resources on profiles in FireFox:
我同意你的问题措辞含糊。 Firefox 允许您拥有任意数量的 cookie 集。 每组都必须是 Firefox 配置文件的一部分。 每个配置文件可以打开任意数量的窗口和进程（注意，为了避免加入现有进程，您必须使用 no-远程）。
我认为您一直在使用具有相同配置文件的多个窗口，这些窗口应该共享一个 cookie 集。
I second that your question is vaguely worded. Firefox allows you to have an arbitrary number of cookie sets. Each set must be part of a Firefox profile. Each profile can have an arbitrary number of windows and processes open (note, to avoid joining an existing process you must use no-remote).
I think you have been using multiple windows with the same profile, which are expected to share a cookie set.