IIS 6/.Net 2:How can user A get the user cookie for unrelated user B who is in a different session and on another box?

Question

1) user A goes to the site, creates an account, and logs in 2) user b goes to the site. Rather than having to log in, user b enters as though user b is user a. User b gets access to all of user a's data and can brows the site as user a.

Note: user b does not log in. User b just hits the site, and the site returns as if user b is already logged in as user a.

Note 2: user a and user b are on distinct computers. Also, static variables are not involved in the code.

Setup: IIS 6 .Net 2.0 OutputCache off for the pages in the site

Answer 1

This question seems quite similar to Apache/Tomcat error - wrong pages being delivered. As my answer to that question mentions, if you use session cookies, check if your Vary header is correct.

Answer 2

Check that you are not storing any data in static (c#) or Shared (VB) variables.

Answer 3

Are users A and B on the same computer?

Answer 4

From research by other team members:

Even though the authentication cookie may be in images from the portal, an authentication cookie with a ticket for David should never have been sent to Todd's browser. Also if images are cached somwhere somehow such that different users get other user's auth cookies then I assume this problem would happen fairly often and should be repeatable. However I am wondering if this is a load balanced system and if so does the load balancer cache anything?

Based on the known issue of users sharing sessions as a result of output caching with ASP.NET, IIS 6.0, and Windows 2003 Server, the problem may only be repeatable 1 out of 100,000 requests (see the 'Sessions and Output Caching' section of this article) http://msdn.microsoft.com/en-us/magazine/cc163577.aspx