Users accesing with same IP address can login the application directly without enter credentials

[Luis Mayoral]

Hello,
We have detected an extrange behaviour with our Bitbucket server (5.10.1).
Some users are connecting to the server using "the same IP address", because they are behind a NAT. When one of them access in the application and later close the browser, the next user can enter directly in the application (without login) and taking the previous user namer.

We can minimize the damage reducing the time of default session timeout, but I think this is not sufficient for us.

Is there any possibility to solve our problem?

Thank you very much

[David Yu]

This is just a shot in the dark, but do you have any type of caching configured in your proxy or load-balancer? Seems like it could be recycling the same sessions between users.

[Luis Mayoral]

Hi,

Finally I solved it adding the following setting in bitbucket.properties file:

server.session.cookie.name=BITBUCKETSESSIONID

Anyway, thank you very much for your answer

best regards