Recyling of sessionID in ASP.NET 2.0

[Ibrahim.]

When a new request is made to the server a new session id is issued to the
client (a browser instance). The problem I’m facing is that session id that
is already assigned to a browser instance is getting recycled for another
browser instance by ASP.NET When the client request is sent to Http server,
the available session id’s (that is already present in the pool) are recycled
from the session pool along with the authentication cookie. Again when a new
request was being done, then available session id is passed on to the client
causing Mix-up of sessions.

The formsauthentication ticket (cookie) is also getting recycled along with
the session cookie session.

Forms authentication ticket is issued if the user selects save me option in
login page.
If the user selects save, then the user id is stored in a cookie encrypted
by forms authentication ticket.


Scenario

In multiuser (concurrent mode) situation, this is causing problem, due to
recyle of session id the forms authencition ticket is getting passed to some
other user who is currently using the site, that means “user z†details are
displayed for “user a†who is some other user accessing the site.

Environement; ASP.NET 2.0, IIS6.0/2003 SERVER.

Please reply if any thoughts

 

[Anthony Jones]

When a new request is made to the server a new session id is issued to the
client (a browser instance). The problem I'm facing is that session id that
is already assigned to a browser instance is getting recycled for another
browser instance by ASP.NET When the client request is sent to Http server,
the available session id's (that is already present in the pool) are recycled
from the session pool along with the authentication cookie. Again when a new
request was being done, then available session id is passed on to the client
causing Mix-up of sessions.

The formsauthentication ticket (cookie) is also getting recycled along with
the session cookie session.

Forms authentication ticket is issued if the user selects save me option in
login page.
If the user selects save, then the user id is stored in a cookie encrypted
by forms authentication ticket.


Scenario

In multiuser (concurrent mode) situation, this is causing problem, due to
recyle of session id the forms authencition ticket is getting passed to some
other user who is currently using the site, that means "user z" details are
displayed for "user a" who is some other user accessing the site.

Environement; ASP.NET 2.0, IIS6.0/2003 SERVER.

Please reply if any thoughts

This is group is for classic ASP for ASP.NET help try:-

microsoft.public.dotnet.framework.aspnet