A few days ago, I appeared in an interview in a software company for .net developer. There I was asked the following question:
If we close browser window without getting logout, what will happen when
we provide same URL in the browser?
My answer was that user will be able to view the home page with login details instead of being prompted to provide username and password as session of the user has not ended. Login information will actually be retrieved from cookies. But it depends upon the logic we have implemented for Login.
But the interviewer didn’t seem be satisfied with my answer and didn’t accept my answer. I am wondering what might be answer of this question. So, I need your kind guidance regarding correct answers. So please explain what I was supposed to reply.
2
Happens the same thing that happens when the user hits the refresh button in the browser.
There are two typical methods for maintain session in http:
-
with cookies, the browser sends the same cookie to the browser because closing the browser don’t delete cookies.
-
with url rewriting, in this case the url has the session info, if you close the browser, then open it and put the same url, that include the session info, the response from the server its the same.
Off course there are other scenarios, like Single Page Applications (or applications running in a browser plugin like flash or an ancient applet), and in this scenarios there is no general answser because all depends in the logic implemented by the application.
0
I think there are five scenarios:
1- The meaning of browser window may be the tab of the browser and user will not lost session. Therefore if he redirects to url there will be no login screen.
2- Developer can keep a flag in database and information from user (ip,browser type, browser fingerprinting, and so on) and can directly authenticate user.
3- The meaning of browser window may be whole browser itself. And if developer did not used cookies user wil not be authenticated.
4- Developer can use cookies and user will be authenticated directly if he even closes the computer.
Lastly, a theory but i am not sure of it. Server kills session by considering users actions. So if user can close and reopen browser so that fast that browser did not stop at background services (etcs windows services) user can be authenticated.