I was testing this on a machine not auth. on the domain, but in IIS, I have set up authenticated access only, so when I point my browser to a dnn-page I'm asked for AD-credentials(User "A"), and then logged into dnn. BUT, when I close this browser, and open another one and point it to the same URL, I'm asked for credentials again, and whichever credentials I give, I'm still logged into dnn as user "A"...

If there is no config-parameter to make this auth-cookie valid only for a session, I think I would have to call this a bug ?

I managed to fix this myself by making the authentication-cookies session based(which they are default, if you dont specify an expirationdate).

I changed the following methods in components\authentication\AuthenticationController.vb to avoid the problem I described earlier:

######################################
Public Shared Sub SetStatus(ByVal PortalID As Integer, ByVal Status As AuthenticationStatus)
Dim authCookies As String = AUTHENTICATION_STATUS_KEY & "." & PortalID.ToString
Dim Request As HttpRequest = HttpContext.Current.Request
Dim Response As HttpResponse = HttpContext.Current.Response

Dim AuthenticationTicket As New FormsAuthenticationTicket(1, authCookies, DateTime.Now, DateTime.Now, False, Status.ToString)
' encrypt the ticket
Dim strAuthentication As String = FormsAuthentication.Encrypt(AuthenticationTicket)

Response.Cookies(authCookies).Value = strAuthentication
Response.Cookies(authCookies).Path = "/"
End Sub

##################################

And in this line in AuthenticationLogon(), I changed
true to false

###################################
FormsAuthentication.SetAuthCookie(Convert.ToString(LoggedOnUserName), True)
###################################

I believe this is a bugfix, but I really can't guarantee it wont adversely affect other setups...