Session Shared between browsers

[TheDrider]

I am having an intermittent issue with several browsers apparently sharing session info. When one user logs in, he receives the session info (UserID) from another broswer's session, and we end up logging in under one account and getting the info for another account that is aleady logged in. Has anyone else seen this?

I am using Sessions with the ClientManagement and SetClientCookies both set to Yes. I verified that I am using correctly scoped locks around the calls to the session's UserID.

I then tried to break the code by setting both ClientManagement and Clientcookies to No. Since I do not pass the URL tokens via code, I thought this would effectively disable session vars as each page has no way of identifying its session. However when I try to log on, the UserID is still saved into a Session variable, but how is that session identified to subsequent pages? Is there something about sessions I am missing?

Thanks,
Dave Miller

 

[tleish]

The code isn't using <CFLOCK> around SESSION variables.

For a full explanation of this, see:

http://www.vboston.com/DepressedPress/Content/ColdFusion/Guides/Locking/Index.cfm

- tleish