title: Image caching, HTTPHandler and FormsAuthentication
body: <p><strong>The Setup:</strong></p>
  
  <p>I'm working on a website that uses <code>Formsauthentication</code> using cookies to store the login ticket.  The site also has an <code>HTTPHandler</code> that manages images stored in the database.  The handler caches the images to be public and expire in 20 minutes.  We have noticed that since the images have the same lifecycle as a page the images also include the <code>Formsauthentication</code> cookie.  The configuration is IIS 6, Win2k server, Content Expiration is not enabled.</p>
  
  <p><strong>The Problem:</strong></p>
  
  <p>What we are experiencing is Person A logs in and hits a couple of pages.  Then Person B hits the default page not logging in and get's the cookie for Person A and is able to see all of Person's A data.  We have reproduced the problem once by turning on Content Expiration in IIS but have not reproduced consistently so we are not sure if Content Expiration helped us reproduce it.  We are assuming since the images are being cached as public and they also contain the cookie with the <code>FormsAuthentication</code>, it's somehow possible for Person B to unintentionally get Person A's cookie.  We know this isn't a attack on the website.</p>
  
  <p>Has anyone experienced anything similar to this behavior? If so, can you provide any advice on how to reproduce this issue consistently?</p>