search

ikyriak / IdempotentAPI

A .NET library that handles the HTTP write operations (POST and PATCH) that can affect only once for the given request data and idempotency-key by using an ASP.NET Core attribute (filter).
MIT License
253 stars 38 forks source link

Potential idempotency issue #57

Closed NotIlya4 closed 11 months ago

NotIlya4 commented 11 months ago

I'm not sure, but if I successfully process the request (e.g., write the transaction to the database) and it fails before saving it in the cache, if the client makes the same request a second time, my app would execute the same transaction twice.

ikyriak commented 11 months ago

Hello @NotIlya4

Thank you for taking the time to report this.

By default, the IdempotentAPI library caches only the responses with 2xx HTTP status codes. However, this is configurable in the attribute. So, if, in your business case, you would like to cache the error response, you should set the CacheOnlySuccessResponses option to false.

If this does not help you, could you provide more information on the issue to be investigated?

NotIlya4 commented 11 months ago

I'm referring to situations where, after successfully writing to the database, my service goes down before saving to the cache. Am I right that, in this case, if a user sends a request again, it will be processed twice, resulting in the same transaction occurring twice? It seems like the only way to prevent this is to write to a separate table with idempotency tokens and a unique constraint column within the same transaction.

ikyriak commented 11 months ago

The source of truth for the IdempotentAPI library is the cache.

Yes, in such a case, in which the application is not gracefully stopped, a following request with the same idempotency key will be processed.

To deal with this, you could store the "idempotency key" in the database in the same transaction (be part of your business code). You could use the IdempotentAPI library by implementing the IIdempotencyCache interface, having your database as a source of truth (either primary or secondary). You can follow existing implementations as examples.

However, you could also investigate how to shut down the application gracefully.

NotIlya4 commented 11 months ago

Gracefully stopping application in prod environment is not possible. Pod/node could go down without any reason at any time))

I'm new in idempotency tokens so I'm looking for different reliable solutions, thanks for the answers)