 <p>If using ASP.NET (this includes MVC and Web API, Web Forms, etc) and AutoFac you should register all your components using the extension method <code>.InstancePerRequest()</code>. The only exception is for components that are thread safe and where you do not have to worry about errors/unexpected results occurring from one request accessing the same (stale) data as another. An example might be a Factory or a Singleton.</p> <p>Example of use on a line of code:</p> <pre><code>builder.Register(c =&gt; new UserStore&lt;ApplicationUser&gt;(c.Resolve&lt;ApplicationDataContext&gt;())).AsImplementedInterfaces().InstancePerRequest(); </code></pre> <p>This ensures that every new incoming Http Request will get its own copy of that implementation (resolved and injected hopefully via an interface). Autofac will also cleanup the Disposable instances at the end of each request.</p> <p>This is the behavior you need. It ensures that there is no cross request interference (like one request manipulating data on a shared dbcontext on another request). It also ensures that data is not stale as it is cleaned up after each request ends.</p> <p>See <a href="http://docs.autofac.org/en/latest/lifetime/instance-scope.html#instance-per-request" rel="nofollow">the Autofac documentation</a> for more details (here an excerpt).</p> <blockquote> <h3>Instance Per Request</h3> <p>Some application types naturally lend themselves to “request” type semantics, for example ASP.NET web forms and MVC applications. In these application types, it’s helpful to have the ability to have a sort of “singleton per request.”</p> <p>Instance per request builds on top of instance per matching lifetime scope by providing a well-known lifetime scope tag, a registration convenience method, and integration for common application types. Behind the scenes, though, it’s still just instance per matching lifetime scope.</p> </blockquote> <p>Changing your DI definitions above to include this should resolve your issues (I think based on what you have provided). If not then it might be a problem with your Identity registration in which case you should post that code so it can be scrutinized.</p>