Azure-Samples / Azure-Samples/ms-identity-python-samples-common

Concurrency issue: Users are logged in as other users

Aperta
#8 0 commenti 1 reazione 0 assegnatari Vedi su GitHub
Lingua principale
Python
Stelle
47
Fork
42
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

### This issue is for a: (mark with an `x`)
```
- [x] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)
```

### Minimal steps to reproduce
> When multiple users accessed our webpage at once and (successfully logged in via this library). After a while some of them got logged in as other users in the backend. This was apparent as we show the username in the Frontend which we get from `_id_token_claims['name']` . Also other requests e.g. for user history accessed data of the wrong user.
We tried to reproduce it in a controlled development environment with multiple users and simulated requests at once and checked if the MS user oid we set manually in the request matched the one acquired via `_id_token_claims` but couldn't reproduce the issue so far. This happened on release to a wider audience

### Any log messages given by the failure
> No errors seen

### Expected/desired behavior
> No concurrency issue

### OS and Version?
> Azure App Services, Python Stack

### Versions
> latest i.e. 0.16.6

### Mention any other details that might be useful
Is this line https://github.com/Azure-Samples/ms-identity-python-samples-common/blob/9b32cef36c6c0b73c1b3237fdd66128d89f90a62/ms_identity_web/django/middleware.py#L29
which sets the adapter for the Middleware but the adapter is initialized with the current request, really thread safe, i.e. for multiple users at once?

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.