Race hidden authentication and workflow substates

An HTTP handler can traverse several security-relevant states before producing its response. A final state that is safe does not prove that another concurrent request cannot observe an unsafe intermediate state.

Research anchor and scope

James Kettle’s state-machine research expands race testing beyond repeated limit overruns to collisions involving hidden substates and multiple endpoints. It also introduces synchronized completion of HTTP/2 requests through a single TCP packet. The transport technique reduces arrival jitter; it does not guarantee simultaneous execution, bypass application locks, or prove that every endpoint waits for a complete body.

Name the invariant

Start with a statement such as “a reset token belongs to exactly one pending address” or “a privileged session is never usable before verification.” List storage keys touched by each handler: session, user row, pending transaction, cart, token, or shared cache entry. Endpoints with different URLs can still collide on the same object.

A toy flow stores a pending email, generates a token, sends mail, then commits the final association. Two overlapping requests might make the token and address come from different logical operations if storage is shared between steps. The interesting observation is an invariant violation in durable state or a delivered artifact, not merely two successful HTTP status codes.

Separate synchronization from observation

Run a sequential control first, then repeat equivalent requests concurrently with the same starting state. Reset that state between trials. Include paired requests in reversed order to distinguish fixed ordering from timing-sensitive behavior. Record both response bodies and later state, because a denied response may still have made a partial update.

For HTTP/2, completion frames can be batched after most of each request is sent. Verify the actual packets rather than assuming a “parallel” UI option accomplishes this. A server that processes immediately after headers may enter the relevant code before the withheld body byte arrives. Upstream connection creation and backend queues can also reintroduce timing differences.

Narrow the collision

Once a broad burst produces an anomaly, reduce it to the smallest pair of operations that reproduce the violation. Adjust relative delays to find which operation needs to enter first. This turns a statistical symptom into a causal explanation and reduces confusing side effects from excess requests.

Distinguish process-local locks, per-session serialization, database transactions, and uniqueness constraints. A transaction may protect one row but not an external email or cache update. Conversely, a failed burst does not establish absence of a race: worker count, connection routing, resource ownership, and state reuse may prevent the attempted schedule. Report the required collision and observed intermediate state as precisely as the final outcome.