Skip to content

Race condition in get_current_user on first sign-in #703

@bencap

Description

@bencap

Problem

When a new user signs in for the first time, multiple concurrent requests can be routed to different servers. Each server independently checks whether the user exists, finds no record, and attempts to INSERT. One succeeds; the other raises an IntegrityError on commit.

The user does end up in the database, so this isn't a data-loss issue — but the losing request surfaces an unhandled error.

Expected behavior

Concurrent first-login requests should all resolve successfully, returning the newly created (or already-existing) user.

Proposed fix

Catch IntegrityError in the user-creation path within get_current_user. On catch:

  1. Roll back the failed transaction.
  2. Re-query the user from the database.
  3. Return the existing user as normal.

This makes the insert idempotent without needing an upsert or distributed lock.

Metadata

Metadata

Assignees

No one assigned

    Labels

    app: backendTask implementation touches the backendtype: bugSomething isn't working

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions