Azure-Samples / Azure-Samples/ms-identity-python-samples-common
Concurrency issue: Users are logged in as other users
- 主要語言
- Python
- 星號
- 47
- 分支
- 42
- PR 合併指標
- 30 天內沒有已合併 PR
描述
### This issue is for a: (mark with an `x`)
```
- [x] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)
```
### Minimal steps to reproduce
> When multiple users accessed our webpage at once and (successfully logged in via this library). After a while some of them got logged in as other users in the backend. This was apparent as we show the username in the Frontend which we get from `_id_token_claims['name']` . Also other requests e.g. for user history accessed data of the wrong user.
We tried to reproduce it in a controlled development environment with multiple users and simulated requests at once and checked if the MS user oid we set manually in the request matched the one acquired via `_id_token_claims` but couldn't reproduce the issue so far. This happened on release to a wider audience
### Any log messages given by the failure
> No errors seen
### Expected/desired behavior
> No concurrency issue
### OS and Version?
> Azure App Services, Python Stack
### Versions
> latest i.e. 0.16.6
### Mention any other details that might be useful
Is this line https://github.com/Azure-Samples/ms-identity-python-samples-common/blob/9b32cef36c6c0b73c1b3237fdd66128d89f90a62/ms_identity_web/django/middleware.py#L29
which sets the adapter for the Middleware but the adapter is initialized with the current request, really thread safe, i.e. for multiple users at once?
貢獻指南
研究方向
從 ms_identity_web/django/middleware.py 第 29 行開始,檢查 adapter 如何根據目前的 request 進行初始化。如果可能,重現並行的已驗證 request,然後判斷使用者身分或歷史資料是否可能跨越 request 邊界。完成的標準是找出並行原因,並透過 regression test 記錄已驗證的修正方案。
由索引模型根據 Issue 內容生成。
評估
- 技術堆疊
- django, python
- 領域
- authentication, backend
- Issue 類型
- 缺陷
- 難度
- 5/5
- 預估耗時
- 一週以上
- 活躍度
- 停滯
- 描述清晰度
- 需要釐清
- 新手友好度
- 25/100