I created an ASP.net application.  For persistence  I am storing the report document in a session object.

This works fine for refreshing and paging the report.

I’m using forms authentication and each user is authenticated in SQL server.

The Application queries a reports database and populates a menu with all the available reports.

Items in the menu are enabled or disabled depending if the user has access not.

Clicking a menu item opens the selected report in a separate page.

As the page opens it again confirms that the user has permission to access the selected report.

The problem is that occasionally users are getting reports that other users have open. It's as if the Session object is not unique to the users session.

This is a big security concern especially if a user in the finance department has a report open.

Any suggestion would be appreciated!

Thank you

Ron