veracitylab / provenance-injector

inject provenance into JEE applications
Apache License 2.0
0 stars 0 forks source link

Race condition between sending provenance HTTP header and pickup #24

Open wtwhite opened 6 months ago

wtwhite commented 6 months ago

The following sequence of requests would fail, due to the fact that we only call pickup() after the original request has completed.

  1. Client: GET /somepage
  2.       Server web app: Begins sending /somepage response including provenance-id: 42 HTTP header
  3. Client: GET /prov/42 ---> FAILURE
  4.       Server web app: Finishes sending /somepage response
  5.       Server web app: Calls ProvenanceTracker.pickup()

It's unreasonable to burden the client with waiting for a (subsequent) notification that the provenance ticket is "ready", so the best solution would be to make GET /prov/<id> block until pickup() has been called iff start() has already returned <id>.

It remains to be seen whether this is an issue in practice.