Request.GetClientCertificate 有时会在 Web API 中返回不正确的信息

Question

I have a.Net 4.6 Web Application running on IIS which reads smart cards to get user information. In the beginning the application was working fine but after a few days other user's card information was showing up for different users. For example someone nowhere near me or associated with me tried to login but my smart card information would show up as though it was read from their card. It is almost like my smart card information is being cached on the server.

This is the code that reads the smart card information.

X509Certificate2 clientCert = new X509Certificate2(Request.GetClientCertificate());

u.Info = clientCert.Subject.ToString();

I just found out that if I restart IIS the credential that was showing will reset and the correct one will show.

Not sure what I am doing wrong that I am not getting the correct smart card information.

Thanks!!

Answer 1

The problem ended up being a static variable.

Static variables creates a single instance of a variable that is accessible by every application user.