Liferay (server) switch a session ID, is it possible?

[10年前 に Petr Vašek によって更新されました。]

Hi all, i have very interesting security problem. I have specific portlet, which processing "something". And i have two users, which are logged to the portal. And they CLICK on one function of this portlet in SAME TIME .(same time on second resolution). And USER1 gets his screen info, BUT USER2 gets USERS1ˇS screen info !!! I check my portlet code 1000000x but i dont find error. This error i failed repeat again !!!. Is it possible, that liferay or tomcat switch a session in one request?

Thank you and so sorry for ma bad english

Petr

[10年前 に Mika Koivisto によって更新されました。]

It is possible if you leak the jsessionid but the problem is still probably in your portlet.