title: ASP.NET Session Mix-up using StateServer (SCARY!)
body: <p>We store two objects in session. Somehow, one of the objects from another user got loaded into a different user's session. The user should have had no access to this particular data, and as soon as they saw it they knew something was very wrong.</p>
  
  <p>We have visual proof of the data that was presented to him, and there is <em>certainly</em> no way it could've happened unless the sessions got mixed up.  This is a very scary situation which we can not figure out (we can not reproduce it). The only answer for us is to blame ASP.NET StateServer for mixing the session variables up, which is completely unacceptable and puts us in a bad position.</p>
  
  <p>Our applications are ASP.NET 2.0 apps running on Windows Server 2003 with IIS6, using the <code>StateServer cookieless="false"</code> session mode and FormsAuthentication.</p>
  
  <p>Has anybody else had this problem?  How can we resolve it?</p>