Azure-Samples / Azure-Samples/ms-identity-python-samples-common

Concurrency issue: Users are logged in as other users

未關閉
#8 0 則留言 1 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
Python
星號
47
分支
42
PR 合併指標
30 天內沒有已合併 PR

描述

### This issue is for a: (mark with an `x`)
```
- [x] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)
```

### Minimal steps to reproduce
> When multiple users accessed our webpage at once and (successfully logged in via this library). After a while some of them got logged in as other users in the backend. This was apparent as we show the username in the Frontend which we get from `_id_token_claims['name']` . Also other requests e.g. for user history accessed data of the wrong user.
We tried to reproduce it in a controlled development environment with multiple users and simulated requests at once and checked if the MS user oid we set manually in the request matched the one acquired via `_id_token_claims` but couldn't reproduce the issue so far. This happened on release to a wider audience

### Any log messages given by the failure
> No errors seen

### Expected/desired behavior
> No concurrency issue

### OS and Version?
> Azure App Services, Python Stack

### Versions
> latest i.e. 0.16.6

### Mention any other details that might be useful
Is this line https://github.com/Azure-Samples/ms-identity-python-samples-common/blob/9b32cef36c6c0b73c1b3237fdd66128d89f90a62/ms_identity_web/django/middleware.py#L29
which sets the adapter for the Middleware but the adapter is initialized with the current request, really thread safe, i.e. for multiple users at once?

貢獻指南

開啟貢獻指南

研究方向

從 ms_identity_web/django/middleware.py 第 29 行開始,檢查 adapter 如何根據目前的 request 進行初始化。如果可能,重現並行的已驗證 request,然後判斷使用者身分或歷史資料是否可能跨越 request 邊界。完成的標準是找出並行原因,並透過 regression test 記錄已驗證的修正方案。

由索引模型根據 Issue 內容生成。

評估

技術堆疊
django, python
領域
authentication, backend
Issue 類型
缺陷
難度
5/5
預估耗時
一週以上
活躍度
停滯
描述清晰度
需要釐清
新手友好度
25/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。