From coreybrett at gmail.com  Tue Sep 20 07:59:06 2022
From: coreybrett at gmail.com (Corey Boyle)
Date: Tue, 20 Sep 2022 07:59:06 -0400
Subject: [Flask] wrong response sent to client
Message-ID: <CAD=ssw1wCt6LOZyY2D3f+b_spRQFt-NVBGWKbFuXvMv6Sm4-Xg@mail.gmail.com>

I don't know where to start with this issue.

I am using Nginx -> UWSGI -> FLASK

I have had users report that they clicked on a link for one page, but
got the wrong page in response, and that after this, they were logged
in as someone else.

It seems like the server sent them the wrong response.

Unfortunately, this only happens on occasion and I don't know how to
trigger it in my dev environment.

Seems like it is probably related to threading in some way, but not
sure how to even start.

I did setup Sentry.io a few weeks ago, and noticed that Flask is
throwing "AssertionError: Popped wrong request context." messages,
maybe one a day, but I am not sure if that is related.

Any thoughts?

From nicolas at lemanchet.fr  Tue Sep 20 08:20:14 2022
From: nicolas at lemanchet.fr (Nicolas Le Manchet)
Date: Tue, 20 Sep 2022 14:20:14 +0200
Subject: [Flask] wrong response sent to client
In-Reply-To: <CAD=ssw1wCt6LOZyY2D3f+b_spRQFt-NVBGWKbFuXvMv6Sm4-Xg@mail.gmail.com>
References: <CAD=ssw1wCt6LOZyY2D3f+b_spRQFt-NVBGWKbFuXvMv6Sm4-Xg@mail.gmail.com>
Message-ID: <f5014168-7d85-4344-8cdf-ea64fd8ffc0b@www.fastmail.com>

Having a client receive the response from another client usually comes from a caching layer that is not configured properly, for example an HTTP response with an incorrect "Vary" header that gets cached by a CDN and served to the next client.

As you mentioned, the assertion error may also indicate that something having to do with thread safety is not used properly.

These kind of problems are notoriously hard to debug, so good luck!

-- 
Nicolas Le Manchet

From coreybrett at gmail.com  Thu Sep 22 17:45:50 2022
From: coreybrett at gmail.com (Corey Boyle)
Date: Thu, 22 Sep 2022 17:45:50 -0400
Subject: [Flask] wrong response sent to client
In-Reply-To: <f5014168-7d85-4344-8cdf-ea64fd8ffc0b@www.fastmail.com>
References: <CAD=ssw1wCt6LOZyY2D3f+b_spRQFt-NVBGWKbFuXvMv6Sm4-Xg@mail.gmail.com>
 <f5014168-7d85-4344-8cdf-ea64fd8ffc0b@www.fastmail.com>
Message-ID: <CAD=ssw2pbOELPrP87Q-PGS6v5RSXZFYFwg8iWe7XX7PgZ+pKWg@mail.gmail.com>

I removed the threads = 4 line from my config, and doubled my processes to
16.

Also added enable-threads = true so that my emailing function would still
work.


So far so good. Haven't had a single error in Sentry since. (Except the
ones I intentionally triggered to make sure it was working.)

I must be using a package that is not thread safe.
Is there a way to test packages for thread safety?

Also added some JS code using localStorage to my app to tell me if the user
switching happens again.

On Tue, Sep 20, 2022, 8:20 AM Nicolas Le Manchet <nicolas at lemanchet.fr>
wrote:

> Having a client receive the response from another client usually comes
> from a caching layer that is not configured properly, for example an HTTP
> response with an incorrect "Vary" header that gets cached by a CDN and
> served to the next client.
>
> As you mentioned, the assertion error may also indicate that something
> having to do with thread safety is not used properly.
>
> These kind of problems are notoriously hard to debug, so good luck!
>
> --
> Nicolas Le Manchet
> _______________________________________________
> Flask mailing list
> Flask at python.org
> https://mail.python.org/mailman/listinfo/flask
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.python.org/pipermail/flask/attachments/20220922/291a8a66/attachment.html>

From ub at artfacts.net  Fri Sep 23 06:52:23 2022
From: ub at artfacts.net (ulrich berthold)
Date: Fri, 23 Sep 2022 12:52:23 +0200
Subject: [Flask] wrong response sent to client
In-Reply-To: <CAD=ssw2pbOELPrP87Q-PGS6v5RSXZFYFwg8iWe7XX7PgZ+pKWg@mail.gmail.com>
References: <CAD=ssw1wCt6LOZyY2D3f+b_spRQFt-NVBGWKbFuXvMv6Sm4-Xg@mail.gmail.com>
 <f5014168-7d85-4344-8cdf-ea64fd8ffc0b@www.fastmail.com>
 <CAD=ssw2pbOELPrP87Q-PGS6v5RSXZFYFwg8iWe7XX7PgZ+pKWg@mail.gmail.com>
Message-ID: <3c27faa3-2ae4-5d0b-056d-0a66ae35a093@artfacts.net>


On 22.09.22 23:45, Corey Boyle wrote:
> I removed the threads = 4 line from my config, and doubled my 
> processes to 16.
>
> Also added enable-threads = true so that my emailing function would 
> still work.

and doesn't the sentry client require threads to begin with?

cheers,

ub

>
>
> So far so good. Haven't had a single error in Sentry since. (Except 
> the ones I intentionally triggered to make sure it was working.)
>
> I must be using a package that is not thread safe.
> Is there a way to test packages for thread safety?
>
> Also added some JS code using localStorage to my app to tell me if the 
> user switching happens again.
>
> On Tue, Sep 20, 2022, 8:20 AM Nicolas Le Manchet 
> <nicolas at lemanchet.fr> wrote:
>
>     Having a client receive the response from another client usually
>     comes from a caching layer that is not configured properly, for
>     example an HTTP response with an incorrect "Vary" header that gets
>     cached by a CDN and served to the next client.
>
>     As you mentioned, the assertion error may also indicate that
>     something having to do with thread safety is not used properly.
>
>     These kind of problems are notoriously hard to debug, so good luck!
>
>     -- 
>     Nicolas Le Manchet
>     _______________________________________________
>     Flask mailing list
>     Flask at python.org
>     https://mail.python.org/mailman/listinfo/flask
>
>
> _______________________________________________
> Flask mailing list
> Flask at python.org
> https://mail.python.org/mailman/listinfo/flask
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.python.org/pipermail/flask/attachments/20220923/3e063b80/attachment.html>