[thelist] JSP Sessions duplicate

[VOLKAN ÖZÇELİK]

Hi all !

I have a peculiar problem: My sessions on the server mix at times.
We use JSP pages and IBM Wepshere Application Server as the
server-side technology.

Let me explain with a scenario:

User A logs in -> a User object is created for him and stored in A's session.
User B logs in -> a User object is created for him and stored in B's session.

this is the normal case as you may guess.

And here is the very rarely-occuring (but occuring anyways) situation:

User B logs in, but when he requests the user Object from his session,
he sees that it is A's User object. (in other words he sees A's name
on the browser window)

(This is not an issue of client-side caching. All the server logs and
database logs indicate that User B is doing things under the name of
user A. This gives A's permissions and priviliges to B, which he may
not have.)

Here is my guess 
- User A logs in, opens a session, gets a session id S.
- Somehow user A gets another session id T and continues communicating
the server via T.

- User B logs in,
- The server gives id S to user B, instead of creating a new session.
Now Both user A and user B are "user A" according to the server.

Please note that this is only my guess and may not reflect the real situation.

Have you ever coincided with something similar? 
What may be the cause of it? 
Do you have any remedies?

Heeelp!

TIA,
Volkan.