SESSION: System confuses users who access it simultaneously

Question

When 2 users access at the same time the system, somehow it confuses the users, not only the name, but their permissions as well...

I am assigning the session after logging into Actionfilter

public class UsuarioAttribute : ActionFilterAttribute

public override void OnActionExecuting(ActionExecutingContext filterContext)
{
    int idUsuario= new UsuarioNegocio().GetIdByExternalId(decodedToken.ExternalUserId.ToInt32());//Id vem de um token

    Usuario usuario = new UsuarioNegocio().GetById(idUsuario);

    filterContext.HttpContext.Session["Usuario"] = usuario;
}

And in Basecontroller I have the following method to recover the session:

public Usuario GetCurrentUser()
{
   return (Usuario)HttpContext.Session["Usuario"];
}

Has anyone ever had this problem with session?

Answer 1

This is the wrong way to persist session user data in ASP.NET MVC.

The alternatives to this are:

• Using an object derived from ProfileBase (explain here);
• Using an authentication provider such as ASP.NET Identity. Examples here.

---

EDIT

You said by answer you’re using OutputCache, which is a global resource. That is, the first user to create the cache will create Session information for all.

[HttpGet, OutputCache(NoStore = true, Duration = 1)]

It seems absurd, but it makes perfect sense, precisely because the data of the session are also maintained by OutputCache.

Answer 2

The problem was found in the controller in the exit method, it was like this:

[HttpGet, OutputCache(NoStore = true, Duration = 1)]

I left only with the get and solved (I can not explain the reason):

[HttpGet]