nxus / router

The Nxus router is an Express compatible web server and router for Nxus applications.
MIT License
0 stars 0 forks source link

Sessions vulnerable to race conditions #14

Closed dheniges closed 7 years ago

dheniges commented 7 years ago

The express-session lib explicitly allows a response to be sent while the session is concurrently saving.

Locally, this caused a session write to get trampled as a new request immediately afterward loaded the session prior to the write finishing, and then overwrote the first session write.

Here's some more info from the express-session maintainer: https://github.com/mweibel/connect-session-sequelize/issues/7#issuecomment-59469816

I haven't run into the issue on any of the heroku environments yet, but behavior can result in failed logins, failure for flash messaging to work, etc.