Beaker sessions lose information with concurrent AJAX requests from the same browser about beaker HOT 2 OPEN

Confirm. Got same issue. Beaker == 1.6.4, Pylons == 1.0.1

from beaker.

This is a known issue with concurrent requests, and is due to the fact that at the beginning of a request the session is read, its updated, then written back. Even though the read/write's are done with locks, that doesn't help since one both requests read the same session at approximately the same exact time.

The only way to fix this (depending on session back-end), is very ugly, which is to lock requests making it impossible for one request to start if another one is using the same session. This way one of the sessions has to wait before it can even read, thus ensuring it doesn't overwrite newer data. Alternatively, a more proactive version could be done where during write, if beaker sees that your sessions 'origin' time is no longer the same, it could deny the save and force you to reload it.

Locking during the entire request is a no-go, but reading an 'origin' time for the session and checking it before saving it is do-able, this way the code could reload the session or take whatever step it wants. Perhaps it could be re-read and the keys merged.

I'm open to pull requests implementing the optimistic save feature to prevent overwrites, but its likely not trivial and will involve:

1. Update the back-end API to ensure an 'origin' time is read.
2. Update the back-end API to ensure the save command also takes the origin time for checking with the back-end
3. Update all the core backends in Beaker to support the two new options
4. Update the Session code to support the new features in the container code
5. Add tests to ensure the optimistic overwriting prevention is handled correctly

So, who's up for it? :)

from beaker.