One of IE8's new features is a that when closing a window or tab, it can remember the session ID and therefore maintain the session with a website. This is an advantage if you accidentally close a window or tab, but there is a problem.

For example, if you have several logins for a site, each login giving totally separate functionality of the site (e.g customer and administrator), then you may close your browser and login as someone else. What you may find is that when you open a new window, you are already logged in as the other person. Why does this happen?

IE8 seems to use the first window a storage mechanism for sites visited in this browsing session. When visiting a site, the unique Session ID is generated and then stored in this host process. When opening new tabs and windows the new process checks the host process to see if the website has been visited and if so returns the existing session ID.

So to re-iterate, if you have at least 1 browser window open, all subsequent tabs and windows pointing to a specific site will all generate the same session ID.

In order to get around this "problem", you should close all instances of IE8. The session information seems to be stored in memory rather than on disk, so by closing all of these instances, the problem goes away.

This serves as a warning to both developers and kiosk/Internet café users. Developers should provide the ability to log out of a site so that the Session is cleaned up after a user logs out. Kiosk/Internet Café users should close ALL Internet browser sessions down before leaving!