Address race conditions (including wallet encrypted with old password gets posted) #20

New issue

Open

opened 2022-09-20 20:43:27 +02:00 by orblivion · 0 comments

orblivion commented

2022-09-20 20:43:27 +02:00

(Migrated from github.com)

Get a new auth token using an old password, despite a password change, and use it to post a new wallet encrypted with the same old password. - See here There could be a similar race condition where a client almost posts a wallet using an auth token that gets deleted by the password change transaction, but I think the Sequence value would save us from that.
Stay connected to a websocket initiated during a password change using an auth token that's invalidated the password change - See here - Not important yet since all we do with the websocket is inform clients about new wallet updates. But, maybe we'll do more important things on the websocket later.

I realized that there are a few ways that race conditions could (however unlikely) get around some enforcement in our code. The most important one is after a password change, preventing a client with the old password from posting a new wallet. * Get a new auth token using an old password, despite a password change, and use it to post a new wallet encrypted with the same old password. - [See here](https://github.com/lbryio/wallet-sync-server/commit/4f074b181c1b53e9155565b1863bf8f1ab955810#diff-9a62b4a044185786fb1bf1c5a2ea3d0d94c2e168d1ed580db8994c06a4f0f41aR498) There could be a similar race condition where a client almost posts a wallet using an auth token that gets deleted by the password change transaction, but I think the Sequence value would save us from that. * Stay connected to a websocket initiated during a password change using an auth token that's invalidated the password change - [See here](https://github.com/lbryio/wallet-sync-server/commit/4f074b181c1b53e9155565b1863bf8f1ab955810#diff-c41ac3e70d598112211df833e1c45f74c34bf9c393970e7dc636fde5853271e4R116) - Not important _yet_ since all we do with the websocket is inform clients about new wallet updates. But, maybe we'll do more important things on the websocket later.