In Rails, what could cause a user to have another user's session?

Question

I have a Rails application using with an authentication system using Restful Authentication without any modification.

Users have reported finding themselves logged in as the wrong user. In at least one case it was on their very first page view, never having logged in before.

Is it possible their session ids are getting mixed up? Would switching to CookieStore make it impossible for this to happen since no session data is stored on the server this way? I suspect the problem is related to Passenger but I don't know where to start debugging this. Its only happened about 4 times in several months of being live so its virtually impossible to reproduce.

Environment: ActiveRecord session storage Rails 2.2.2 Passenger 2.0.1 Apache 2 Ruby 1.8.6

Many thanks

Answer 1

If you use a client-side session storage (default for newer Rails versions), it may be a mistake in the application and not a stolen session (or something like that). Make sure that you know which session storage you use and how it works.