There are 3 web apps.
Site A and B are both ASP.NET Web Application with FormsAuthentications configurations, and there is a protected folder in site B which also configured correctly in the web.config. Site C is a classic ASP web which keep authentication status with Session.
Now please consider the following steps:
1, There is a link with target="_blank" property on a page of site A and link to the protected folder of site B;
2, Click this link you should open the site B in a new browser window and redirect to the log in page;
3, Log in with your credentials then redirect to the protected page normally, now you can browse that page of site B of course;
4, Now close the browser window which shows the protected page of site B, you can click the close button of browser or press Alt+F4;
5, Then click the link on site A again, now you can access the protected page of site B without logging in ag ...
Go to the complete details ...