title: .NET Session Hopping in Web Farm
body: <p>Recently migrated our .NET website to a Cloud environment with a gateway server acting as an IIS Web Farm to load balance our requests.  </p>
  
  <p>Our application uses forms authentication through cookies and the web farm has server affinity checked at the Client level.  </p>
  
  <p>At least one to many times per day, a client will call us stating they see someone else's name on our "Logged in as" area.  Checking our logs, that "other" person is in fact logged in.  The authorization cookie has a timeout period of 8 hours.  We are looking into reducing this to 1 hour with a popup warning letting the user know they are about to be logged out.</p>
  
  <p>Any ideas as to how to fix this or prevent it from happening?</p>