I have the following problem in my web application.
I hold userId and roleId as two session attributes when user login,
and in each page write userId as active user and check roleId for some
work. when user logout, I set these attribute with null.
When two or more users login concurrently or not, in some machines,
that's work well but at one of them (windows server 2003), attribute
value changed.
For example, user X login and after viewing some pages logout and then
another user Y login. when user Y want to view pages, in some of them
user X is wrote as active user whereas user X has logged out. I don't
know why, specially when I see this work well in another machines.