We a re facing a major security issue in which a user once logged into our website gets another user's profile.
i.e. if user A logs in, he may get profile of user B. So if A tries to post a comment on the site, it gets posted as from user B. This is completely random and we have not got exact steps / scenarios to reproduce this.
I have written following peice of code in Application_AuthenticateRequest event of one of the HTTP modules.
if (!string.IsNullOrEmpty(username))
{
System.Security.Principal.GenericIdentity identity = new System.Security.Principal.GenericIdentity(username);
System.Security.Principal.GenericPrincipal principal = new System.Security.Principal.GenericPrincipal(identity, new string[] { "Role" });
context.User = principal; //context is current HTTPContext
System.Web.Security.FormsAuthentication.SetAuthCookie(userna ...
Go to the complete details ...