Hello,
Our login systems set some parameters under a cookie and check the parameters in the cookie and decode it wheter the users login or not on the other pages. We put a new web site on our production side and its some pages have output cache. After that our user can access each other accounts and it was a huge security hole. We took off the output cache from the files and everything back to normal.
<%@ OutputCache VaryByParam="id;newsid" Duration="180" %>
Does Output cache store also asp.net sessions or cookie parameters in the cache memory? The web site also works under impersonate user. Does anyone has any idea about the problem.
Thanks
...
Go to the complete details ...