Concurrent requests using the same idempotency key may be able to pass the idempotency check before either request persists its result, potentially allowing the underlying operation to execute more than once.
To Reproduce
Identify an API endpoint that supports idempotency keys.
Prepare two identical requests with the same idempotency key.
Send both requests concurrently rather than sequentially.
Observe whether both requests execute the underlying operation or create separate records/resources.
Expected Behavior
For concurrent requests using the same idempotency key, the operation should be executed exactly once. Subsequent concurrent requests should receive the same persisted result as the original request.
Actual Behavior
Under concurrent execution, there may be a race between checking and creating the idempotency record, allowing multiple requests to execute the underlying operation before the idempotency state is persisted.
Environment
OS: [your OS]
Node.js Version: [your version]
Zoneless Version/Commit: [commit tested]
Additional Context
This is particularly important for payment and payout operations, where duplicate execution could result in duplicate financial transactions.
The audit should also verify that idempotency enforcement is atomic at the database level and remains safe when requests arrive concurrently or when the original request fails during processing.
Concurrent requests using the same idempotency key may be able to pass the idempotency check before either request persists its result, potentially allowing the underlying operation to execute more than once.
To Reproduce
Identify an API endpoint that supports idempotency keys.
Prepare two identical requests with the same idempotency key.
Send both requests concurrently rather than sequentially.
Observe whether both requests execute the underlying operation or create separate records/resources.
Expected Behavior
For concurrent requests using the same idempotency key, the operation should be executed exactly once. Subsequent concurrent requests should receive the same persisted result as the original request.
Actual Behavior
Under concurrent execution, there may be a race between checking and creating the idempotency record, allowing multiple requests to execute the underlying operation before the idempotency state is persisted.
Environment
OS: [your OS]
Node.js Version: [your version]
Zoneless Version/Commit: [commit tested]
Additional Context
This is particularly important for payment and payout operations, where duplicate execution could result in duplicate financial transactions.
The audit should also verify that idempotency enforcement is atomic at the database level and remains safe when requests arrive concurrently or when the original request fails during processing.