Session overlap, 2 users logged in somehow the system sees them as one.

Question

Hello guys,

Rarely our system mixes logged in users and I can't figure out why.

Here is the scenario: 2 users log in (A and B) normally each one has his own ID, at some point one of the users (A) takes the ID of the other user (B) and contribute to the website as if he is B.

Technically that's what is going on:

1- 2 users logs in: each user requests a "log in" action from Single Sign On(SSO) server which runs on PHP, and a session is created for each user (sessions are stored at Memcached-X)

2- The users have different IDs: Each user will have another session on the web server which runs on Ruby (RoR) also saves sessions on Memcached-Y. For each page they enter on RoR there is an iFrame check that request an authentication from the user browser to the SSO.

3- At some point user A becomes B and B stays as B: The log files from SSO show that the user A is still user A and user B is still user B, while the RoR's logs show that user A become B given that it still have the same session id. At that particular moment we checked keys coming out from RoR's memcached and they returned the right values.

What is going on ? Does SSO give wrong values to RoR,or does the RoR mix everything up or are the Memcached servers making mistakes ?

Please help I am running out of ideas... Thanks.

Answer 1

Is there some sort of time check when querying which session to use? If it's always user A turns into user B (I'm assuming here that user A logs in FIRST) then perhaps somewhere along the way user A looks up session info and sorts by time.

It sounds like it's in the communication between ROR and SSO, if both logs are confirming the correct user IDs/session IDs then it has to be somewhere in between when that check happens?

Answer 2

It turned out that memcached that holds the session for RoR, was holding the same session information for 2 different session keys, either Ruby is mixing it up or Memcached, I highly doubt the later.