[mod_python] Protecting Web apps from to many simultaneous clicks/Hacking

On Fri, 14 May 2004, Byron Ellacott wrote:

> > 1	sess=Session.Session(req, None, cookieSecret)
> > 2	if not sess.has_key('REQUESTS'):
> > 3		sess['REQUESTS']=1
> > 4		sess.save()
> > 5	else:
> > 6		sess['REQUESTS']+=1
> > 7		sess.save()
> > 8		while sess['REQUESTS']>1:
> > 9			sleep(1)
> > 10	sess['REQUESTS']-=1
> > 11	sess.save()
>
> I've added line numbers to help the discussion.  So, you create a
> session object at line 1.  This is when the locking should already have
> occurred.  In lines 2-4, you introduce a race condition: if a second
> process preempts your request after line 2, but before line 4, that
> process will also get False from sess.has_key('REQUESTS').  This means
> two separate processes will reach line 3 thinking they have exclusive
> access to the session.  A similar race condition exists between lines 6
> and 7.

With session locking on (which would be true in the code above), once one
process reaches 2, no other process will be able to get past 1 until the
first request is over. So there is no race condition, unless I'm missing
something.

Also, since it isn't obvious, sess.save() does not release the lock. The
lock can be released explicitely with unlock(), or it would be released
for you in the request cleanup phase.

Grisha