title: Sessions mixed up on asp.net site
body: <p>I am analyzing a problem from an old asp.net site made by one of my colleagues who left the company some months ago. </p>
  
  <p>The problem is that we a few times have expierenced that two users sessions are mixed up, so that if for example two users are logged in, one user sees the other users data. As it happens very rarely (once in a month or so) it is difficult to figure out what goes wrong. </p>
  
  <p>I have now stepped through his code for authentication and it goes like this:</p>
  
  <ol>
  <li>The user enter username/password on public page and press submit</li>
  <li>On <code>Page_Load</code> on Masterpage the code checks in a mySql database that the username/password is valid, not expired etc and return a unique userid if ok</li>
  <li>The page then saves the loginpage in session like this (used for later logout):
  <code>HttpContext.Current.Session(Consts.CCookieName_LoginUrl) = Request.RawUrl</code></li>
  <li>Then the userid is saved like this: <code>FormsAuthentication.SetAuthCookie(userid, False)</code></li>
  <li>Then a redirect to the secure area is performed: <code>Context.Response.Redirect(secureurl, False)</code></li>
  <li>In <code>Page_Init</code> of masterpage of secure area the userid is read by: <code>userid = Context.User.Identity.Name</code> </li>
  <li>the user data is loaded acording to the userid</li>
  <li>The user navigates the secure area, ie. step 6 - 7 is repeated</li>
  <li>The user suddently sees another users data</li>
  </ol>
  
  <p>I have some ideas on what is going wrong, but would like to have some input before modifying the code, so please anyone?</p>