title: Asp.net Sessions Getting Crossed / Mixed Up
body: <p>Few weeks ago we had one of our customers contacting us saying that sometimes when he creates an activity it gets created under someone else's name!  </p>
  
  <p>We did some troubleshooting and couldn't find anything. We asked the user to contact us the next time he was experiencing these issues. He did contact us and we were able to do a gotomeeting with him and see the issue with our own eyes.  </p>
  
  <p>It was not only the activities, he was recognized as someone else in the application. He had access to everything that other person should had access to. That was when we realized we are having a session mixed up issue.</p>
  
  <p>A little bit about our code:<br>
  Like any other application we have a simple login page that user enter email and password and we authenticate them against our database and if they are valid we call FormsAuthentication.SetAuthCookie() to save current user id in the cookie and we let him in.</p>
  
  <pre><code>BL.User currentUser = BL.User.Authenticate(txtUsername.Text, txtPassword.Text);
  
  if (currentUser != null)
  {
      this.Session["NumberOfLoginTried"] = "0";
      FormsAuthentication.SetAuthCookie(currentUser.UserID.ToString(), chRememberMe.Checked);
      Response.Redirect(FormsAuthentication.GetRedirectUrl(currentUser.UserID.ToString(), false));
  }
  </code></pre>
  
  <p>We also use the following piece of code to get logged-in user id (current user) in our application.</p>
  
  <pre><code>public static int GetCurrentUserID()
  {
      int userID = -1;
      int.TryParse(HttpContext.Current.User.Identity.Name, out userID);
      return userID;
  }
  </code></pre>
  
  <p>And yes we did our homework and googled around and have seen the following two links:</p>
  
  <p><a href="http://lionsden.co.il/codeden/?p=446" rel="noreferrer">http://lionsden.co.il/codeden/?p=446</a><br>
  <a href="https://stackoverflow.com/questions/1646274/asp-net-session-mix-up-using-stateserver-scary">ASP.NET Session Mix-up using StateServer (SCARY!)</a></p>
  
  <p>We have disabled kernel-mode caching and user-mode caching for .aspx and .ascx files and this is still happening. </p>
  
  <p>P.S- The app is running on Windows 2008 R2 with IIS 7.5. And we are <strong>NOT</strong> using cookieless session.</p>