userID Session variable data changing!?

[nell1]

We have a Windows 2003 web Edition server running IIS 6. On the webserver we are running an application using classic ASP using JScript as the scripting language and MySQL 4.1 as the backend DB.

The user logs in and their userid is saved to a session variable. With that variable they can access/change various information within their profile.

However, what appears to be happening is that somehow, their userid within the session changes and they get other users data. Am completely stumpted as to how this can be happening. It appears to happen completely randomly, or at least I have failed to see a pattern yet. At no point is the session programatically changed by us. Have taken our router out of the equasion for now just in case it is a hardware/routing issue.

Would appreciate some advice,

Regards

Nell1

 

[Sheco]

If Bob gets John's data, what is the relationship between Bob and John?

1) Do they share the same physical machine?
2) Are they both using the web app at the same time from different computers?
3) Is there any relationship between the two users within the log-in validation scheme? Perhaps the validation is stored in a database table and users are on sequential table rows?
4) Could this be a cache error?

 

[nell1]

Hi Sheco, thanks for the reply.

1.) They do not share the same physical machine. The application is for a specific client so the majority of the users are accessing from the same location. I am guessing that it is the same location as the web logs have recorded the same IP which I am guessing that they are NATing behind a router.
2.) SOme are using at the same time and others are not. All from different computers.
3.) No relationship that I can see.
4.) Cache error.. where abouts do you mean? Server side?

Nell1

 

[Sheco]

Since the users are not sharing machines then it can't be the browser cache but web pages are still sometimes cached by both web servers and proxy/firewall servers.