Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Have received some reports from a customer (a very large company) they reported issues from clients who are using Facebook.

These clients claim that once in a while when they log in to Facebook they end up in someone else's session.

I know that network is NATed then Proxied before getting to

Although I'm not able to explain how this issue can occur.

Is it possible that the Proxy is not sending the right session back to the clients?

How can they end up with someone else's session since Facebook is cookie based session??

Anyone seen this before?

share|improve this question
up vote 1 down vote accepted

There's a known vulnerability that makes Facebook susceptible to cross-site scripting attacks. It's possible that something like this is going on.

Here's a write-up of it.

share|improve this answer
Thanks for the answer, although, could that explain how a non-techy person end up browsing a colleague's facebook account simply by going on – Alex Mar 11 '11 at 16:04

Are they using a proxy service on the firewall? It may be possible that facebook related pages containing session cookies are getting cached. Depending on the order pages are loaded it could replace the session cookie with someone else's cookie.

It should be less of a problem with https connections which shouldn't be cached.

share|improve this answer

NAT couldn't be the source of it, however a session is merely a cookiestring and if the same cookie string is sent out to multiple computers, then basically both computers would end up in the same session.

A proxy could do that, but that would mean that both facebook and the proxy does some rather problematic stuff. afaik facebook only sends out the session cookie string after login on the https site, which means that it shouldn't have been cached.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.