News for hackers. Stuff that matters.

A comment on A bug related to handling of authenticated sessions. Parent comment

Re:A bug related to handling of authenticated sessions by gruez on Tuesday March 09, 2021 @08:41AM (#26398635)
>1) something with thread-local storage saving the the auth info in the request handler, and then coroutines or async code that is overwriting that thread-local with info from a new request before the old request has finished.

AFAIK github is written in ruby. Does it even have thread local storage?

[ Parent | on HN ]
Re:A bug related to handling of authenticated sessions by ghiculescu on Tuesday March 09, 2021 @09:37AM (#26399153)
Yes, at least in Rails you see this a bit:

> Thread.current[:key] = value

Typically you’d only have one request at a time on each thread though. So your examples feel unlikely. Looking forward to finding out what happened here.

[ Parent | on HN ]