note 48962 deleted from function.session-cache-limiter by didou

Note Submitter: Nicola ---- My last post is bogus. At the end of the day the problem was that we had something inside the session-controlled area which would check that your credentials were OK. If they weren't, you would be bombed out of the session area; a public file outside the session area was directly included; that file would then set the headers to public. That way in certain cases pages which used cookies inside the session areas would be marked as publicly cacheable. Some proxies somewhere on the net (AOL's) would cache them entirely, including the cookies. That means next time someone requested that page, they might get a cached page from another user, including cookies. At that point the new cookie would replace the session cookie and two users would have the same session cookie. Then all sort of confusing situations with logins would happen. Sorry for the previous incorrect post. Hope this helps