Azure-Samples / Azure-Samples/ms-identity-python-samples-common
Concurrency issue: Users are logged in as other users
- Dominant language
- Python
- Stars
- 47
- Forks
- 42
- PR merge metrics
- No merged PRs in 30d
Description
### This issue is for a: (mark with an `x`)
```
- [x] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)
```
### Minimal steps to reproduce
> When multiple users accessed our webpage at once and (successfully logged in via this library). After a while some of them got logged in as other users in the backend. This was apparent as we show the username in the Frontend which we get from `_id_token_claims['name']` . Also other requests e.g. for user history accessed data of the wrong user.
We tried to reproduce it in a controlled development environment with multiple users and simulated requests at once and checked if the MS user oid we set manually in the request matched the one acquired via `_id_token_claims` but couldn't reproduce the issue so far. This happened on release to a wider audience
### Any log messages given by the failure
> No errors seen
### Expected/desired behavior
> No concurrency issue
### OS and Version?
> Azure App Services, Python Stack
### Versions
> latest i.e. 0.16.6
### Mention any other details that might be useful
Is this line https://github.com/Azure-Samples/ms-identity-python-samples-common/blob/9b32cef36c6c0b73c1b3237fdd66128d89f90a62/ms_identity_web/django/middleware.py#L29
which sets the adapter for the Middleware but the adapter is initialized with the current request, really thread safe, i.e. for multiple users at once?
Contributor guide
Assessment
This issue has not been assessed yet.