My site allows anonymous users.
I saw that under heavy load user get sometimes profile values from other users.
This happens for anonymous users.
I logged the access to profile data:
/// <summary>
///
/// </summary>
/// <param name="controller"></param>
/// <returns></returns>
public static string ProfileID(this Controller controller )
{
if (ApplicationConfiguration.LogProfileAccess)
{
StringBuilder sb = new StringBuilder();
(from header in controller.Request.Headers.ToPairs()
select string.Concat(header.Key, ":", header.Value, ";")).ToList().ForEach(x => sb.Append(x));
string log = string.Format("ip:{0} url:{1} IsAuthenticated:{2} Name:{3} AnonId:{4} header:{5}",
controller.Request.UserHostAddress,
controller.Request.
Url.ToString(),
controller.Request.IsAuthenticated,
controller.User.Identity.Name,
controller.Request.AnonymousID,
sb);
_log.Debug(log);
}
return controller.Request.IsAuthenticated ? controller.User.Identity.Name : controller.Request.AnonymousID;
}
I can see in the log that user realy get the same cookievalue for .ASPXANONYMOUS even if they have different IP.
Just to be safe I removed dependency injection for the FormsAuthentication.
I dont use OutputCaching.
My web.config has this setting for authentication:
<anonymousIdentification enabled="true" cookieless="UseCookies" cookieName=".ASPXANONYMOUS"
cookieTimeout="30" cookiePath="/" cookieRequireSSL="false" cookieSlidingExpiration="true" />
<authentication mode="Forms">
<forms loginUrl="~/de/Account/Login" />
</authentication>
Does anybody have an idea what else I could log or what I should have a look at?
