Server Cache Issue or Something Else?

[Proc]

I am hoping someone here can point me in the right direction with a
problem my user's are experiencing. Here is what is happening:

I have an ASP.NET application that several users will use at the same
time in a classroom-like setting. They access the application
concurrently and occasionally experience an issue where one user
starts accessing the application (they click on a link which sends
their name and login information to the ASP.NET application via the
querystring) and then they see their name displayed on the screen.
Another user, on a completely different PC, then accesses the same
page and they see the information (name) of the first user instead of
their own (which is being sent properly). This is happening at
several locations, using several different internet connection types,
and its very sporadic and cannot be recreated at will.

I believe this is only happening when the client PC's are sharing an
IP address through a router, and even then it is only happening very
rarely. The users are able to workaround the issue by clicking the
Back button on their browser and clicking the link to the application
again.

I know the problem isn't browser or client-side cache related (because
it is happening across different machines), and I have tried the
following code in my application:

Response.Expires = 0
Response.Cache.SetNoStore()
Response.AppendHeader("Pragma", "no-cache")

Am I completely missing something? Does anyone have any
recommendations on how to correct or debug this? Any help you can
provide would be extremely appreciated.

 

[Scott Allen]

Hi Proc:

Some troubleshooting thoughts:

Are you using server side caching? ( @OutputCache directive?).

Are you keeping any user data in the Application object or in a static
/ shared field?

One other comment:
Sending the login information through the query string is not going to
be very secure.

 

[Proc]

Scott:

Thanks for the reply. I am definitely not using any server side
caching via the "@OutputCache" directive. Also, I don't keep any user
data in the Application object.

Can you explain what you mean by a "static / shared field"? I don't
believe I am doing anything like that, but I can look into it once I
know more about what you mean.

Thanks for the warning about the querystring. Actually none of the
data being sent via the querystring is confidential, no passwords or
actual login identifiers are being passed. Its just the person's name
and a few other public fields. I do understand the concern there, and
always make sure to take it into account when it comes to security.

Thanks, and if there are any other recommendations, please feel free
to speak up.

 

[Scott Allen]

Hi Proc:

In VB you can mark a member of a class as shared (in C# the keyword is
static). Keeping a username, for example, in a shared property or
shared variable means all requests see the same value. I suspect this
isn't the problem since it would probably give consistently wrong
results, but it's something to check.

 

[Proc]

Thanks for the explanation. That's what I thought you were talking
about. I definitely don't have any shared members or anything (don't
even use the keyword "Shared" anywhere in this application.

I'm really thinking this is some sort of server cache thing, but I
cannot figure out how to debug it since it happens so infrequently.

Does anyone know if the following code completely shuts down the
server cache functionality? Or am I missing something?

Response.Expires = 0
Response.Cache.SetNoStore()
Response.AppendHeader("Pragma", "no-cache")

Again, thanks for any information you can provide.