Sessions/Session IDs being assigned to more than one user

[prideleader]

I'm running on IIS 7 and we're seeing Sessions assigned to more than 1 IP address.

I ruled out the possibility of it being caused by users resetting their IP addresses, for instance by unplugging their modems.

In at least one instance a user logged in and found data from a different user in had been saved to his account (the user IDs that determine in which account the data is stored are kept in session variables). In another instance an employee logged in to check a problem as was given the session of a different user.

It's not just the session variables, but I saw in our log the session ID itself is being associated with two different IP addresses. At one point this was happening with over 10% of our users.

I'm wondering if the problem is not in our system, because I'm seeing that in each case the IPs sharing a session ID are on the same ISP or share at least one NameServer.

I very much welcome any ideas, we're getting desperate!

[Frinavale]

I'm not sure how your users are able to access eachother's Session data. This is not how Session has been designed to work.

Session IDs that are associated with the same IP address seems common to me. If a user is on the same network as someone else they will likely share the same IP address as another person on the same network.

Session is tied to the user's browser (usually) through cookies....a Session Identifier cookie is sent to the browser so that that browser can be associated with the Session that has been assigned to that browser.


If you have configured your Session to be cookieless then the session identifier is not stored in a cookie....it's stored in the URL (in the query string).

This means that if the user copies the link from the address bar in the browser and sends it to another user, the same session will be used.

-Frinny

[prideleader]

The answer is that it is an issue with the caching in IIS7. I've written more about it here: http://lionsden.co.il/codeden/?p=446