Starcounter/Starcounter.Authorization

PageSecurity.EnhanceClass is not thread safe

Opened this issue · 1 comments

PageSecurity.EnhanceClass is responsible for altering TypedJson schema of a view-model to include permission checking. Problems can now occur, because:

  1. Two threads access a view-model for the first time and they both enhance it at the same time, mangling their modifications
  2. Two threads access a view-model for the first time and one enhances it, while the other is using it
  3. There can be more problems

There should be locking in this method, but since it's on a path of every request a naive lock statement could hurt performance significantly.

... altering TypedJson schema of a view-model to include permission checking.

I think, that this operation shall happen inside a lock and during application startup. Adding more and more checks per request will contribute to the overall app latency, while doing it once on app start will only affect app startup time.