Problem with cookie expiration set to 0 in IE8

Question

I have found a fairly significant issue with IE8 with regard to setting cookie expirations to 0 (so as to log a user out when they close the browser). It seems that each new tab or window is counted as a new session, so if a user opens a page on the site in a new tab/window, they have to login again unless they selected the option to stay logged in, which makes the cookie persistent and doesn't cause any problems. There has got to be a way to make this work like it should and always has in the past without forcing my users to stay logged in even after they close the browser. If it matters, I am setting the cookies from pHP like this:

setcookie("username",$username,0," ",".example.com");

Answer 1

the issue could be the space in the path field. this attribute should be unspecified or should be a valid path like /home. try specifying an empty string ('') instead of space.

could also be a caching thing, ie the login page may appear to be unauthenticated because the content was cached. session_cache_limiter('nocache') in php would instruct the browser not to cache anything (when using sessions), which is the same as setting:

Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache

to omit the path, you can pass '' (empty string) or null to setcookie for that param. or use something like '/' to indicate the entire site.

ie8 windows and tabs share the same session unless the user selects "File -> New Session" or runs iexplore.exe -nomerge explicitly.