I want my users to be able to leverage the IE8 and IE9 New Session feature to be able to log into our ASP.NET web application as a different user. I'm using ASP.NET forms authentication to issue a non-persistant auth cookie (I do not want to use the url based cookie technique). The problem I'm seeing is that the auth cookie that was issued to the user when they logged into the app using the original IE8/9 browser instance gets brought over to the "New Session" browser instance. The user's session is not brought over (which is good), but I would expect that the non-persistant (thus session based) authentication cookie should not come over either. Is this a known issue?
...
Go to the complete details ...