search

TheGU / mod-auth-token

This module uses token based authentication to secure downloads and prevent deep-linking. Have your script or servlet generate a token to authenticate the download and let Apache handle the file transfer without having to pipe it through a script for security.
Apache License 2.0
0 stars 0 forks source link

suspect a race condition sometimes causes "300 gone" #40

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago 
What steps will reproduce the problem?
1. I do a lot of mod_auth_token "double hit" downloads via a download program
2. always when doing 40 concurrent downloads some of the tokens will expire
3. always some of the tokens do not expire but download wrong file

What is the expected output? What do you see instead?
I expect to see mod_auth_token prepare a x second url that works

What version of the product are you using? On what operating system?
1.0.5

Please provide any additional information below.

it is very hard to replicate, but I had had numerous users mention it on the 
website but I was sceptical, because I had not seen it myself, I have a desktop 
client that hits an authenticated php to get a token via json, that token is 
then the "real" download, when I do a mass download (70 files) it will 
invariably stop randomly and produce a "gone" error in the response. at the 
moment i can't give you this code but I would urge doing a stress test. make 
200 file. give them all unique easily findable name. (EG: 2.test inside is 5000 
number 2 characters" then make a screen scrape routine that will question the 
200 files as tokens then go wget those tokens then write a 3rd routine to check 
that 2.list really has "5000 2's in it" I will write this whole thing and end 
it to you but if you do this you will see that it will fail "gone" about one in 
40 and a similar incidence will be wrong file

Original issue reported on code.google.com by conrad.b...@gmail.com on 20 Jul 2014 at 10:03

GoogleCodeExporter commented 9 years ago 
email me conrad dot bate at gmail dot come

Original comment by conrad.b...@gmail.com on 20 Jul 2014 at 10:05

GoogleCodeExporter commented 9 years ago 
it is a "410 gone response" not 300

Original comment by conrad.b...@gmail.com on 20 Jul 2014 at 10:06