ASP.NET Session State Security Problem
<p>I have a website in which people's 'logged in' state is confirmed by their session cookie (and a value within the session which they get after they log in). The cookie is set to httpOnly &amp; require SSL.</p>

<p>Let's say somebody has 2 Firefox windows open, window (A) has my application and they are logged in, and window (B) has something else open.</p>

<p>If they close window (A) without explicitly logging out, then open a new window (C) and access a logged-in-only resource from my web application, it will still load because the cookie is <em>still</em> there and they are authenticated. The timeout on my sessions is already very low, but I need to stop this attack possibility because people may access their data on a public computer.</p>

<p>How can I prevent this from happening?</p>
