Login security issue.

External Since: Mar 21, 2005 Posts: 2

I've setup an ASP page to allow users to change their password from a
website in ADS. The script I have is working, I can change the password,
then login with a workstation with the new password and the old password
won't work.

However, if I connect to a website requiring basic authentication, both
passwords work. I've tried closing all browsers to make sure its not
locally cached, plus I've even logged in from a workstation that had no
browsers open and had not previously been authenticated.

It seems to take about 20 minutes for till the old password stops working,
20 minutes is the same as the session timeout.

Could I be reconnecting to the same session even though I've closed all
browsers?

Any ideas on how not to have this happened?

TIA

External Since: Aug 22, 2003 Posts: 1637

"Michael" <michaelteff.RemoveThis@hotmail.com> wrote in message
news:ujpUjUjLFHA.1948@TK2MSFTNGP14.phx.gbl...
> I've setup an ASP page to allow users to change their password from a
> website in ADS. The script I have is working, I can change the password,
> then login with a workstation with the new password and the old password
> won't work.
>
> However, if I connect to a website requiring basic authentication, both
> passwords work. I've tried closing all browsers to make sure its not
> locally cached, plus I've even logged in from a workstation that had no
> browsers open and had not previously been authenticated.
>
> It seems to take about 20 minutes for till the old password stops working,
> 20 minutes is the same as the session timeout.
>
> Could I be reconnecting to the same session even though I've closed all
> browsers?
>
> Any ideas on how not to have this happened?

This explains it:
<a style='text-decoration: underline;' href="http://support.microsoft.com/default.aspx?scid=kb;en-us;152526" target="_blank">http://support.microsoft.com/default.aspx?scid=kb;en-us;152526</a>

--
Tom Kaminski IIS MVP
<a style='text-decoration: underline;' href="http://www.microsoft.com/windowsserver2003/community/centers/iis/" target="_blank">http://www.microsoft.com/windowsserver2003/community/centers/iis/</a>
<a style='text-decoration: underline;' href="http://mvp.support.microsoft.com/" target="_blank">http://mvp.support.microsoft.com/</a>
<a style='text-decoration: underline;' href="http://www.iistoolshed.com/" target="_blank">http://www.iistoolshed.com/</a> - tools, scripts, and utilities for running IIS