Skip to content

fix(Session): avoid race conditions on clustered setups - #46398

Merged
blizzz merged 2 commits into
masterfrom
fix/46165/token-race
Jul 11, 2024
Merged

fix(Session): avoid race conditions on clustered setups#46398
blizzz merged 2 commits into
masterfrom
fix/46165/token-race

Conversation

@blizzz

@blizzzblizzz commented Jul 10, 2024

Copy link
Copy Markdown
Member

Summary

  • re-stablishes old behaviour with cache to return null instead of throwing an InvalidTokenException when the token is cached as non-existing
  • token invalidation and re-generation are bundled in a DB transaction now

Maybe that is not the final solution to this problem.

Checklist

@blizzzblizzz added bug 3. to review Waiting for reviews labels Jul 10, 2024
@blizzz
blizzz requested review from a team, Altahrim, ChristophWurst, juliusknorr, nickvergessen, sorbaugh and yemkareems and removed request for a teamJuly 10, 2024 11:17
@blizzz

Copy link
Copy Markdown
MemberAuthor

/backport to stable29

@blizzz

Copy link
Copy Markdown
MemberAuthor

/backport to stable28

@blizzz

Copy link
Copy Markdown
MemberAuthor

/backport to stable27

- re-stablishes old behaviour with cache to return null instead of throwing
an InvalidTokenException when the token is cached as non-existing
- token invalidation and re-generation are bundled in a DB transaction now
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
@blizzz
blizzzforce-pushed the fix/46165/token-race branch from 346e5c6 to 6a783d9CompareJuly 10, 2024 11:28
$this->atomic(function () use ($sessionId, $uid, $loginName, $pwd, $name, $remember) {
$this->tokenProvider->invalidateToken($sessionId);
$this->tokenProvider->generateToken($sessionId, $uid, $loginName, $pwd, $name, IToken::TEMPORARY_TOKEN, $remember);
}, \OCP\Server::get(IDBConnection::class));

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ℹ️ cannot be passed as early dependency in the constructor, it would break setup.

prefer to keep this check as PublicEmitter should be dropped sooner or
later
Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

@juliusknorrjuliusknorr left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That sounds reasonable and would safeguard if a second request would try to get the token between the delete and insert of the first request. 👍

@dsisysteme

Copy link
Copy Markdown

We manually applied your proposal to our test platform on version 29.0.3, and it appears to effectively resolve our looping issue after authentication with user_saml as explained in #46165

@ChristophWurstChristophWurst left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense

@blizzz

Copy link
Copy Markdown
MemberAuthor

Cypress is unrelated and fixed with #46428 → merge

@blizzz
blizzz merged commit 95af299 into masterJul 11, 2024
@blizzz
blizzz deleted the fix/46165/token-race branch July 11, 2024 07:24
@blizzzblizzz mentioned this pull request Jul 11, 2024
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Invalid LocalCache Token on a Load-Balanced System

5 participants

@blizzz@dsisysteme@ChristophWurst@juliusknorr@joshtrichards