10

Possible Duplicate:
Hijacked session: Signed in as someone else

Today I was in the same local network as two other stackoverflow users and we were all three logged into our accounts. User A was looking at the public profile of User B, then I visited the profile of B, too. Suddenly, the top bar which usually says my name, clearly displayed User A while I was on the profile of User B. I was able to click on the arrow beside his ("my") name and see his recent activity, but luckily, any further request was again in my name.

I can not tell if this is actually a security issue or just a minor bug, but I have the feeling that this should not happen just because we were in the same network and had the same public IP. I could also think of some proxy between us and the internet caching the reply for his request and sending it to me. Are there any other explanations of how this could have happen or is it possibly a security flaw of so?

Update

I experimented today with the user GameScripting again on the same network and we can reproduce it pretty easily. We go for example to the "Week" tab (just so we both see the same questions), then one of us opens one question, after that the other one requests the same page. He sees the wrong username, reputation, eventually up- and downvotes of the other one on this page and I can see the additional "review" tab which is usually not existent for me because of my low rep. All data that is beeing loaded via ajax was always the correct data, for example the inbox in the menu on the top left. Also, interactions like voting something up or down always failed.

Although some people told us that this "is probably the fault of the website", the proxy must have some impact. We were not able to reproduce it via a shared mobile phone, and also, the second requests felt like it loaded tremendously faster compared to the first request (although not everything was cached, for example the ads, which are loaded from another domain). Notebooks of people with no account always got the "anonymous" page, seems like only "account swapping" was possible, not suddenly "getting an account".

I don't want (you) to solve a problem with this local-network-proxy-stuff, I just wonder if there is anything stackexchange can do to prevent such incidents. I initially chose meta because I thought of a possible bug in stackoverflow itself, but I get the feeling that this might be related to web security in general. One thing that caught my attention is the Cache-Control setting in the HTTP Headers of 60, which might be related to the issue.

Another note: we had the issue never on the frontpage, and apparently, it only works one time per question / profile.

4
  • 14
    This is almost certainly a proxy on your local network being overly eager in caching the result of the User B profile. Unfortunately, buggy over-eager caching proxies abound, and there is nothing SE can do about that. Jan 14 '13 at 17:28
  • 5
    Why not leave this open as a legitimately answered question. There is a reasonable explanation and burying / hiding the real answer in a comment. Even if few people browse from behind a buggy / over eager caching proxy, this sure seems like it might help others that find themselves in that situation going forward.
    – bmike
    Jan 14 '13 at 19:40
  • Similar to this, which affected me as well: Account mixup on Stack Overflow That said I reopened this because it's not too localized. Jan 15 '13 at 1:46
  • My bet is something like this. It certainly sounds like it, since the page was the same. You may want to talk to whoever is providing that network. Also, who is User A?
    – balpha
    Jan 15 '13 at 7:36

Browse other questions tagged .