Race condition
Behavior that depends on the timing of concurrent operations. A time-of-check to time-of-use race (CWE-367) separates a check from the action it guards; make the check and the action one atomic operation.
- Also called
- TOCTOU · time-of-check to time-of-use
- Defined in
- MITRE CWE-362
Covered in
Preserve business invariants under concurrent requests
Make a balance, reservation or approval rule hold when requests overlap, retry and fail halfway through.
Create temporary files safely: mkstemp, O_EXCL and private directories
Stop symlink, hardlink and pre-created-file attacks on the temporary files your code writes in shared directories such as /tmp: create each file atomically with O_EXCL and owner-only permissions through mkstemp or its equivalent in shell, Python, Java, Node.js, Go, .NET and Rust, keep related files in a private directory, and treat the Linux protected_* sysctls and systemd PrivateTmp as a backstop.
Practice: Race condition lab: Repair a balance check that races · Business logic lab: Price an order without trusting the client · Local project: Make a checkout transaction atomic