asp.net application iis7 sessionstate is crossing over multiple users in different locations

Question

got a asp.net web app (2.0) which we moved over from iis 6 to iis 7. it worked good for 6 months. three days ago we have been seeing issues that one loged in users sees other user information. ( session info ) session is in proc

the only thing i see different is iis7 app pool is in integrated mode.

we have taken the app down. app web config is as below

<system.webServer>
<validation validateIntegratedModeConfiguration="false"/>
<modules>
  <remove name="ScriptModule"/>
  <add name="ScriptModule" preCondition="managedHandler" type="System.Web.Handlers.ScriptModule, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
</modules>
<handlers>
  <remove name="WebServiceHandlerFactory-Integrated"/>
  <remove name="ScriptHandlerFactory"/>
  <remove name="ScriptHandlerFactoryAppServices"/>
  <remove name="ScriptResource"/>
  <remove name="WebServiceHandlerFactory-ISAPI-2.0"/>
  <add name="ScriptHandlerFactory" verb="*" path="*.asmx" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
  <add name="ScriptResource" verb="GET,HEAD" path="ScriptResource.axd" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" preCondition="integratedMode"/>
  <add name="CrystalImageHandler.aspx_GET" verb="GET" path="CrystalImageHandler.aspx" type="CrystalDecisions.Web.CrystalImageHandler, CrystalDecisions.Web, Version=10.5.3700.0, Culture=neutral, PublicKeyToken=692fbea5521e1304" preCondition="integratedMode"/>
  <add name="ScriptHandlerFactoryAppServices" verb="*" path="*_AppService.axd" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
</handlers>

does any one have a clue what it could be the application did not have this issue in iis6 for a year n didnt have any issues in iis7 for 6 months.

we are not using any global variables...

Answer 1

iis7 has a feature / bug output cashing over application pool

for 3.5 (classic) mode need to explicitly turn it off on .aspx extentions IIS7 Sessions Getting Crossed / Mixed Up / Copied I have detected a problem on a web farm: IIS 7 Sessions of the useres were getting Crossed / Mixed Up / Copied. A user was getting the session of another!!!!

After some research I found that IIS 7 now has the ability to cache dynamic content as well. It is a new feature in IIS7, this version of IIS introduced some new caching features. (i) IIS7 automatically caches static content, such as HTML pages, images, and style sheets. (ii) IIS7 now has the ability to cache dynamic content as well.

In IIS7, disable the caching for .aspx pages in any directory with an asp.net page that depends on the session state. The steps to do this are: 1. Run the Server Management console and navigate to Roles -> Web Server (IIS) -> Internet Information Services. 2. Select the site you wish to modify. 3. Select the folder that contains the .aspx pages you need to turn caching off for. 4. In the Feature View, double-click “Output Caching”. 5. If there is a rule there already for the .aspx extension double click it. Otherwise right click and select “Add…” 6. Enter .aspx for the “File name extension” 7. Check "User-mode caching", "Prevent all caching", check "Kernel-mode caching" and "Prevent all caching"