Security problem/issue ASP.Net Session

[Gilles]

Hello,
I'm facing a big problem in an Asp.Net application, when
users connect the application, I store their user
informations into the session object (session_start).
But when 2 users click (nearly) at the same time on the
page myprofile, the first user sees his profile (the
correct one) and the second sees the profile of the first
(very bad).
the "HttpContext.Current.User.Identity" is not the
expected one.
web.config entries:
<authentication mode="Windows"/>
<identity impersonate="false"/>
<authorization>
<allow users="*"/>
</authorization>
<sessionState mode="InProc" cookieless="false"
timeout="20"/>
The Web Server is set to:
"Integrated Windows authentication"
and "Anonymous access" is disabled.
Any idea ?
Many thanks for your help.
Gilles

 

[William F. Robertson, Jr.]

What does your Session start code look like? Is it thread safe?

bill