Same session in different computers

Question

hi all,
i have a web reporting package running in sun java application server. i am keeping user object in session scope with following code in all pages which need user information like user.name, user.message, etc.
<jsp:useBean id="user" class="somepackage.User" scope="session" />
i have a front controller to check authentication and authorization. that i developed a year back. it was working fine. from that time i never concentrated on authentication and authorization because that front controller is taking care of authentication and authorization of all requests.
today i observed that if i login in one computer, who ever uses that web application next in another computer, is getting my username and my privileges.
in my first observation it is happening only to explorer. i will check firefox thoroughly tomorrow.
i am using this logic for the last few years without any problem.
the users are behind firewall/proxy server (because i can see only one ip address for all of them.)
can anyone help me in solving this? or how to proceed or how to separate the problem...etc
thanks in advance,
ksmoses.

Answer 1

vignesh and BalusC,
following is the code in front controller's doFilter method. is this not thread safe?
        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse res = (HttpServletResponse) response;
        HttpSession session = req.getSession();
        somepackage.User user;
        if(session.getAttribute("user") == null){
            user = new somepackage.User();
            session.setAttribute("user", user);
        }else{           
            user = (somepackage.User) session.getAttribute("user");
        }user object maintains all information about a user. if it is in session scope, everything should work fine.
another observation is after some time of usage, both people in different systems are getting same session.getId()
in my logout page i am using
session.invalidate();
thanks,
moses