FIX: Windows Opened by Script Lose Authentication or Session

This article was previously published under Q196383
This article has been archived. It is offered "as is" and will no longer be updated.
When windows are opened from script in an HTML page using orShowModalDialog, Internet Explorer responds by prompting users to entertheir username and password every time a new window is created. Thishappens even though the user already entered a correct username andpassword and successfully authenticated with the Web server.

New windows may also lose Web server session information, creating a newsession or reusing an older, incorrect session from a separate InternetExplorer instance.

Also, if the new window contains a Java applet that accesses static information from a class, it may not be able to share that information with an applet in another window.

These symptoms do not appear if the Windows Desktop Update is installed and the browser is not set to "Browse In New Process."
When asked to create new windows through script, Internet Explorer mightcreate the window in the wrong Internet Explorer process. Becauseauthentication credentials and the temporary cookies used for sessionidentification are cached per process, new windows need to re-authenticateand start a new session if they don't open in the same process as theiropening window.

This behavior can appear random; the determined process for new windows isdependent on several variables, including timing and browser configuration.
To resolve this problem, upgrade to the latest version of Internet Explorer or Microsoft Windows NT 4.0 Service Pack 6a (SP6a). You can download the latest version of Internet Explorer from the following Microsoft Web site:Disabling the "Browse In New Process" browser setting in the Advanced tabof the Internet Options will alleviate most of the symptoms described inthis article.

However, Web servers should avoid relying on this as a solution. Web sitesthat expect users to change browser settings will have a negative userexperience, particularly when other sites require a different value for thesame settings. Users in corporate environments may not even have controlover this setting. Furthermore, disabling "browse in new process" canaffect the stability of the system shell and some users may need to use"Browse In New Process" when they are working with pages that contain a lotof Active Content.

Note that all session-managed pages should be set to expire immediately.Some session inconsistencies can result when pages are pulled from thecache rather than from the Web server.
Microsoft has confirmed that this is a bug in the Microsoft products that are listed at the beginning of this article. This bug was corrected in Internet Explorer 4.01 Service Pack 2 and Internet Explorer 5.

Steps to Reproduce Behavior

  1. Create the following Active Server Pages (ASP) page on an InternetInformation Server machine, version 3.0 or later, in a scripts directory:
          <%@ LANGUAGE="VBSCRIPT" %>      <HTML><HEAD><TITLE>Test for Session ID</TITLE></HEAD>      <BODY>      ASP SESSION ID:      <%= Session.SessionID %>      <P>      <FORM><INPUT TYPE=BUTTON ID=PushME onclick="return openwindow();"             VALUE="WindowOpen"></FORM>      <SCRIPT>      function openwindow()      {"test.asp");      }      </SCRIPT>      </BODY></HTML>						
  2. Verify that the "Browse In New Process" setting is selected in Internet Explorer on the client machine. This setting is in the Browser Settings section in the Advanced tab of the Internet Options dialog box.
  3. On the client machine, launch exactly one Internet Explorer instance. Navigate to the ASP page created in step 1. Click the "WindowOpen" button to execute and create a new window.

    Note that the ASP Session ID matches in both child and parent window.
  4. Create a new Internet Explorer instance by invoking Internet Explorerfrom the Start menu or Desktop icon. Again, navigate to the ASP page created in step 1. Click the "WindowOpen" button.

    Note that the ASP Session ID does not match in both child and parentwindow of the new process. In some cases, this may be the session ID ofthe first pair of Internet Explorer windows.
Similar symptoms can occur when working with Office documents or otherActive Document servers in a Web environment.

For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
185978 FIX: Double GET requests and cookies are lost with Word 2000 or Excel 2000

Article ID: 196383 - Last Review: 12/05/2015 09:49:25 - Revision: 2.0

Microsoft Internet Explorer 4.0 128-Bit Edition, Microsoft Internet Explorer 4.01 Service Pack 2, Microsoft Internet Explorer 4.01 Service Pack 1

  • kbnosurvey kbarchive kbbug kbfix kbie500fix kbqfe KB196383