WebApp Sec: Unable to impersonate another user although having its cookie

[Juan Kinunt <kinunt () gmail com>]

Hi,

I'm auditing a web application programmed in CakePHP and I'm having a problem.
I'm almost sure the authentication mechanism is carried by a cookie
but I'm unable to impersonate another user using its cookie.
The probe I do is opening two sessions with two different users (one
in internet explorer and one in firefox). Then I copy the cookie
belonging to one user and substitute it in a request done by the other
user (using WebScarab). The app throws and error and disconnects the
validated and legal user.
I think that some info is stored in server side about the client who
owns each cookie.

Is this possible? Is it the normal operation in sessions in CakePHP?

Any info or pointer would be very useful.

Thanks.