title: Different users get the same cookie - value in .ASPXANONYMOUS
body: <p>My site allows anonymous users.
  I saw that under heavy load anonymous users get sometimes profile values from other users.</p>
  
  <p>I first delete my cookies and get a valid unique value in the cookie value .ASPXANONYMOUS. After a couple of requests I get a new value for .ASPXANONYMOUS which is already used by another user. I see in my loggs that there are always a couple of users who share the same value in .ASPXANONYMOUS.</p>
  
  <p>I can see in the my logs that 2 or more users realy get the same cookievalue for .ASPXANONYMOUS even if they have different IP.</p>
  
  <p>Here is the htttp traffic. In the second image the changing cookie is shown (You have to display the image full size do be able to read the log):</p>
  
  <p><strong>One of the many requests that work ok:</strong></p>
  
  <p><a href="http://img413.imageshack.us/img413/2711/log1.gif" rel="nofollow noreferrer">alt text http://img413.imageshack.us/img413/2711/log1.gif</a></p>
  
  <p><strong>Then there is this one request that changes the cookie</strong>
  <a href="http://img704.imageshack.us/img704/8175/log2.gif" rel="nofollow noreferrer">alt text http://img704.imageshack.us/img704/8175/log2.gif</a></p>
  
  <p><strong>Then the new cookie is used</strong></p>
  
  <p><a href="http://img704.imageshack.us/img704/3818/log3.gif" rel="nofollow noreferrer">alt text http://img704.imageshack.us/img704/3818/log3.gif</a></p>
  
  <p>Just to be safe I removed dependency injection.
  I dont use OutputCaching.</p>
  
  <p>My web.config has this setting for authentication:</p>
  
  <pre><code> &lt;anonymousIdentification enabled="true" cookieless="UseCookies" cookieName=".ASPXANONYMOUS" 
        cookieTimeout="30" cookiePath="/" cookieRequireSSL="false" cookieSlidingExpiration="true" /&gt;
  
    &lt;authentication mode="Forms"&gt;
          &lt;forms loginUrl="~/de/Account/Login" /&gt;
      &lt;/authentication&gt;
  </code></pre>
  
  <p>Does anybody have an idea what else I could log or what I should have a look at?</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>I saw now that the http-traffic I showed is perfectly valid. A changing value in .ASPXANONYMOUS is something that happens because the cookie gets refreshed. The value contains AnonymousID and a Timestamp. </p>
  
  <p>This does not lead to users having the same value in .ASPXANONYMOUS under normal conditions. </p>
  
  <p>The problem realy is, that whenever the cokies get set from the AnonymousIdentificationModule, then there is a chance that a couple of user get this cookie. Setting a cookie in my application  doesnt have this strange sideefect.</p>