login context vs session

[Cantor, Scott]

On 4/8/13 10:55 PM, "Paul Hethmon" <paul.hethmon at clareitysecurity.com>
wrote:
>
>Ok, good to know I'm not crazy. I do seem to have this particular customer
>with a high rate of this happening. So far I haven't found anything
>significantly different in the logs.

Do they actually observe the results of this? In my case, I never got much
indication people were seeing this happen, which made me think it was a
case of iframes or something like that.

>I can run this server with debug on, at least for a period of time, if you
>think moving up to trace level might bring out something more useful.

I think to get anything, we'd need the cookies logged in the web access
log, and be able to follow the set/send sequence to see if the session's
actually disappearing on the server side or not. Your log sort of implies
that, but it's hard to tell unless we know for sure that the session ID
it's looking up was actually just set or used by the previous step.

In my case I don't see how that's possible so I ruled that out as a cause.

I'm not seeing any sign of IP address flapping either, so it's not that.

-- Scott