title: C# Application compromises cookie data when two or more concurrent sessions are run
body: <p><strong>Background</strong> </p>
  
  <p>I have an application where users can log in and enter their time details. And I recently introduced a new table via which we can distinguish the users from different companies. Users can edit/view/update/delete their own company entries. 
  The database looks like this </p>
  
  <pre><code>COMPANY  ---  STAFF  --  TIMESHEET  --  PROJECTS
  </code></pre>
  
  <p>All these tables are connected via foreign keys.</p>
  
  <p>I am using C#, ASP.NET, ADO.NET, SQL Server to run this application, I am storing <code>companyId</code> in user authentication cookie upon login and then matching that key everywhere to match with the database.</p>
  
  <p><strong>My issue</strong></p>
  
  <p>Whenever I run two instances of localhost, and I click on the same page together, data from different company id is being shown to me.</p>
  
  <p><strong>Edit:</strong> adding more code:</p>
  
  <p>Code to get company id from authentication cookie:</p>
  
  <pre><code>if (string.IsNullOrEmpty(ticket.UserData))
      companyId = Convert.ToInt32(logB.GetCompanyId(email));
  else
  {
        try
        {
            companyId = Convert.ToInt32(ticket.UserData);
        }
        catch
        {
            companyId = Convert.ToInt32(logB.GetCompanyId(email));
        }
  }
  </code></pre>
  
  <p>Using that <code>companyId</code> to get staff details</p>
  
  <pre><code>public void GetCustomerData(string email)
  {
          StaffBLL staff = user.GetStaff(email, companyId);
  
          if (staff != null)
          {
              name.InnerText = staff.Name + " " + staff.LastName;
          }
          else 
              Response.Redirect("../error/500");
  }
  </code></pre>
  
  <p>ADO.NET code:</p>
  
  <pre><code>if (myConnection.State != ConnectionState.Open)
      myConnection.Open();
  
  string query = "SELECT field1,field2,field3,field4, field5,field6,field7,field8 FROM [dbo].[Staff] WHERE  Email=@email AND CompanyId = @companyId";
  
  SqlCommand getStaff = new SqlCommand(query, myConnection);
  
  getStaff.Parameters.AddWithValue("@email", email);
  getStaff.Parameters.AddWithValue("@companyId", companyId);
  
  SqlDataReader reader = getStaff.ExecuteReader();
  StaffBLL staff = new StaffBLL();
  
  try
  {
      while (reader.Read())
      {
          staff.field1 = reader[0].ToString();
          staff.Name = reader[1].ToString();
          staff.field3 = reader[2].ToString();
          staff.field4 = reader[3].ToString();
          staff.field5 = reader[4].ToString();
          staff.field6 = reader[5].ToString();
          staff.field7 = Convert.ToInt32(reader[6]);
          staff.field8 = Convert.ToDateTime(reader[7]);
      }
  
      reader.Close();
  }
  catch (Exception ex)
  {
      Console.WriteLine(ex);
  }
  myConnection.Close();
  </code></pre>
  
  <p>I have changed most of the field names on purpose</p>
  
  <p><strong>Edit 2</strong>
  Tried more debugging</p>
  
  <p>So when i try to debug and added a break point in the page load and if i run two sessions at the same time, i am stopped at the break point for both sessions and the cookie data is unique for each but once i hit continue for both, the cookie data to whatever the second request is, is used for both the sessions. you can view the user id's in both screenshots
  <a href="https://i.stack.imgur.com/kyUXl.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/kyUXl.png" alt="First hit"></a></p>
  
  <p><a href="https://i.stack.imgur.com/FH5wO.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/FH5wO.png" alt="Second hit"></a></p>