Skip to content

fix(auth): confirm a missed session on the write host before 401ing (9893 root cause) #1055

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
edwh merged 5 commits into from
Jul 14, 2026
Merged

fix(auth): confirm a missed session on the write host before 401ing (9893 root cause) #1055

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
c8d6ba9
fix(auth): confirm a missed session against the write host before 401…
edwh Jul 12, 2026
7ce9a51
docs: regenerate screenshots [skip ci]
Jul 12, 2026
d092c5d
Merge master into fix/authmw-session-read-after-write-9893
edwh Jul 12, 2026
5a1fda4
docs: regenerate screenshots [skip ci]
Jul 13, 2026
1d169e7
Merge remote-tracking branch 'origin/master' into pr1055
edwh Jul 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion iznik-server-go/user/authMiddleware.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ import (
"github.com/freegle/iznik-server-go/utils"
"github.com/getsentry/sentry-go"
"github.com/gofiber/fiber/v2"
"gorm.io/plugin/dbresolver"
"sync"
"time"
)
Expand Down Expand Up @@ -41,8 +42,19 @@ func NewAuthMiddleware(config Config) fiber.Handler {

// We have a uid. Check if the user is still present in the DB.
// Also fetch systemrole for HAProxy rate limit exemption.
result := db.Raw("SELECT users.id, users.lastaccess, users.systemrole FROM sessions INNER JOIN users ON users.id = sessions.userid WHERE sessions.id = ? AND users.id = ? LIMIT 1;", sessionIdInJWT, userIdInJWT).Scan(&userIdInDB)
const q = "SELECT users.id, users.lastaccess, users.systemrole FROM sessions INNER JOIN users ON users.id = sessions.userid WHERE sessions.id = ? AND users.id = ? LIMIT 1;"
result := db.Raw(q, sessionIdInJWT, userIdInJWT).Scan(&userIdInDB)
dbQueryErr = result.Error

// Read/write split: the session row is INSERTed on the write host at login, so a
// read replica can momentarily return zero rows right after login (Galera apply
// lag). That would make the check below wrongly 401 a valid session. On a miss,
// confirm against the write host before treating the session as invalid.
// .Clauses(dbresolver.Write) is a no-op when no replica is configured.
if dbQueryErr == nil && userIdInDB.Id == 0 {
result = db.Clauses(dbresolver.Write).Raw(q, sessionIdInJWT, userIdInJWT).Scan(&userIdInDB)
dbQueryErr = result.Error
}
}()
}

Expand Down