Hijacked session: Signed in as someone else
Today I was in the same local network as two other stackoverflow users and we were all three logged into our accounts.
User A was looking at the public profile of
User B, then I visited the profile of
B, too. Suddenly, the top bar which usually says my name, clearly displayed
User A while I was on the profile of
User B. I was able to click on the arrow beside his ("my") name and
see his recent activity, but luckily, any further request was again in my name.
I can not tell if this is actually a security issue or just a minor bug, but I have the feeling that this should not happen just because we were in the same network and had the same public IP. I could also think of some proxy between us and the internet caching the reply for his request and sending it to me. Are there any other explanations of how this could have happen or is it possibly a security flaw of so?
I experimented today with the user GameScripting again on the same network and we can reproduce it pretty easily. We go for example to the "Week" tab (just so we both see the same questions), then one of us opens one question, after that the other one requests the same page. He sees the wrong username, reputation, eventually up- and downvotes of the other one on this page and I can see the additional "review" tab which is usually not existent for me because of my low rep. All data that is beeing loaded via ajax was always the correct data, for example the inbox in the menu on the top left. Also, interactions like voting something up or down always failed.
Although some people told us that this "is probably the fault of the website", the proxy must have some impact. We were not able to reproduce it via a shared mobile phone, and also, the second requests felt like it loaded tremendously faster compared to the first request (although not everything was cached, for example the ads, which are loaded from another domain). Notebooks of people with no account always got the "anonymous" page, seems like only "account swapping" was possible, not suddenly "getting an account".
I don't want (you) to solve a problem with this local-network-proxy-stuff, I just wonder if there is anything stackexchange can do to prevent such incidents. I initially chose meta because I thought of a possible bug in stackoverflow itself, but I get the feeling that this might be related to web security in general. One thing that caught my attention is the
Cache-Control setting in the HTTP Headers of 60, which might be related to the issue.
Another note: we had the issue never on the frontpage, and apparently, it only works one time per question / profile.