Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(Session): avoid race conditions on clustered setups #46398

Merged
merged 2 commits into from
Jul 11, 2024

Conversation

blizzz
Copy link
Member

@blizzz blizzz commented Jul 10, 2024

Summary

  • re-stablishes old behaviour with cache to return null instead of throwing an InvalidTokenException when the token is cached as non-existing
  • token invalidation and re-generation are bundled in a DB transaction now

Maybe that is not the final solution to this problem.

Checklist

@blizzz blizzz added bug 3. to review Waiting for reviews labels Jul 10, 2024
@blizzz blizzz requested review from nickvergessen, ChristophWurst, Altahrim, juliusknorr, a team, yemkareems and sorbaugh and removed request for a team July 10, 2024 11:17
@blizzz
Copy link
Member Author

blizzz commented Jul 10, 2024

/backport to stable29

@blizzz
Copy link
Member Author

blizzz commented Jul 10, 2024

/backport to stable28

@blizzz
Copy link
Member Author

blizzz commented Jul 10, 2024

/backport to stable27

- re-stablishes old behaviour with cache to return null instead of throwing
  an InvalidTokenException when the token is cached as non-existing
- token invalidation and re-generation are bundled in a DB transaction now

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
@blizzz blizzz force-pushed the fix/46165/token-race branch from 346e5c6 to 6a783d9 Compare July 10, 2024 11:28
$this->atomic(function () use ($sessionId, $uid, $loginName, $pwd, $name, $remember) {
$this->tokenProvider->invalidateToken($sessionId);
$this->tokenProvider->generateToken($sessionId, $uid, $loginName, $pwd, $name, IToken::TEMPORARY_TOKEN, $remember);
}, \OCP\Server::get(IDBConnection::class));
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ℹ️ cannot be passed as early dependency in the constructor, it would break setup.

prefer to keep this check as PublicEmitter should be dropped sooner or
later

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
Copy link
Member

@juliusknorr juliusknorr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That sounds reasonable and would safeguard if a second request would try to get the token between the delete and insert of the first request. 👍

@dsisysteme
Copy link

We manually applied your proposal to our test platform on version 29.0.3, and it appears to effectively resolve our looping issue after authentication with user_saml as explained in #46165

Copy link
Member

@ChristophWurst ChristophWurst left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense

@blizzz
Copy link
Member Author

blizzz commented Jul 11, 2024

Cypress is unrelated and fixed with #46428 → merge

@blizzz blizzz merged commit 95af299 into master Jul 11, 2024
163 of 165 checks passed
@blizzz blizzz deleted the fix/46165/token-race branch July 11, 2024 07:24
@blizzz blizzz mentioned this pull request Jul 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Bug]: Invalid LocalCache Token on a Load-Balanced System
5 participants