title: asp.net membership provider compromised?
body: <p>I'm using the standard out-of-the-box aspnet membership provider, and I have the following settings in the web.config:</p>
  
  <pre><code>&lt;anonymousIdentification enabled="false"/&gt;
  &lt;authentication mode="Forms"&gt;
      &lt;forms cookieless="AutoDetect" loginUrl="~/XXXX.aspx" name="XXXXAuth" slidingExpiration="true" timeout="432000"/&gt;
  &lt;/authentication&gt;
  ...
  &lt;membership defaultProvider="XXXMembershipProvider"&gt;
      &lt;providers&gt;
          &lt;add name="XXXMembershipProvider" type="System.Web.Security.SqlMembershipProvider" applicationName="XXX" connectionStringName="XXX" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="true" minRequiredPasswordLength="5" minRequiredNonalphanumericCharacters="0" passwordFormat="Hashed" maxInvalidPasswordAttempts="5" passwordAttemptWindow="10" passwordStrengthRegularExpression=""/&gt;
      &lt;/providers&gt;
  &lt;/membership&gt;
  </code></pre>
  
  <p>Today I have had an issue where a user has reported that they went to log-in and noticed that the site was saying they were already logged-in.... as a completely different user.  After contacting both users, it turns out neither accesses the site from a shared computer.  Neither account's data shows any sign of being "hacked" in the database.</p>
  
  <p>The is hosted on two web servers behind a load balancer.  The database architecture is one server for reads, one for writes with replication keeping them in sync.</p>
  
  <p>Does anyone know what might have occured to cause this?</p>