resgateio / resgate

A Realtime API Gateway used with NATS to build REST, real time, and RPC APIs, where all your clients are synchronized seamlessly.
https://resgate.io
MIT License
685 stars 67 forks source link

Possible to get two timeout responses #114

Closed jirenius closed 4 years ago

jirenius commented 4 years ago

Issue

In theory, it is possible to get two responses (first a timeout, then a another response) on a request due to a race condition. This may happen if a preresponse that extends the timeout is handled by Resgate at the same moment as the request times out.

This is due to Resgate currently not checking whether it successfully stopped the previous timer before starting a new.

See https://github.com/resgateio/resgate/blob/v1.2.2/nats/nats.go#L236-L238

Impact

This bug has no security impact. It may however cause errors in the client which doesn't expect a second response on a single request.

There are no known occurrences of this bug actually being triggered.

jirenius commented 4 years ago

Resolved in PR #117