Race Conditions and Limit Overrun

Classic pattern: read limit, decide OK, write new state. Between read and write, another request does the same. Both saw “available.” Both succeeded. The design assumed single-threaded humans. The fix is not “hope.” The fix is one atomic operation or a uniqueness constraint the second write cannot violate. You will demonstrate that gap on a toy HTTP counter under cyberlium-lab — never on a payment network.

Limit overrun is the business name for the same gap when the limit is quantity, budget, invites, or “once.” Rate limiting at the edge helps bots; it does not replace transactional integrity for money-like counters.

sudo apt install curl

SAFE="http://127.0.0.1:8773"

curl -sS -m 3 "$SAFE/counter" | head -n 12
curl -sS -m 3 -X POST "$SAFE/counter/inc" | head -n 12

Name the controls you would require in a design review: database transaction with row lock or serializable isolation for the counter; UNIQUE(user_id, coupon_id) so the second insert fails; Idempotency-Key on payment-like POSTs so retries do not double-apply; queue a single worker for contested resources. You do not need a vendor cookbook — you need the sentence “two concurrent applies cannot both succeed.”

Idempotency is design: the client may retry; the server must treat duplicate keys as one effect. Document where keys are stored and how long. Empty “we will add locks later” fails A06.

sudo apt install curl

SAFE="http://127.0.0.1:8773"

curl -sS -m 3 -I "$SAFE/" | head -n 10

Public writeups sometimes show racing checkout on real brands. That is out of scope here. Your lab is a Python HTTP counter in $HOME/cyberlium-lab that intentionally has a check-then-act bug, then a fixed version with a lock. No card numbers. No foreign hosts. No hydra on the router. No nmap of 192.168.0.0/24. If it feels too small without real money, that feeling is how people cross into unauthorized testing.

Report shape on YOUR app: asset http://192.168.0.1/ or SAFE, steps on loopback, expected single success, actual double success, invariant, proposed atomic control. Stop.

When uniqueness or locks deny the second writer, log actor, resource, and outcome without secrets. A09 will deepen logging; A06 already needs the design to emit that signal so limit abuse is visible. Silent success on both writers is the insecure design.

Carry forward: races are design until proven otherwise. Implementation without locks is how the design fails in production.

Start a06_counter_toy.py (binds 127.0.0.1:8773). GET /broken/apply (check-then-act, may overrun). GET /fixed/apply (lock). Two curls close together on broken; record. No bank. No hydra.

sudo apt install curl
sudo apt install nmap
sudo apt install python3

brew install nmap
brew install python3

choco install nmap  # or download https://nmap.org/download.html

cd "$HOME/cyberlium-lab"

cat > a06_counter_toy.py << 'PY'
"""Teaching check-then-act vs lock. Bind loopback only."""
from http.server import ThreadingHTTPServer, BaseHTTPRequestHandler
import threading
import time
from urllib.parse import urlparse

HOST = "127.0.0.1"  # bind only — never 0.0.0.0, never argv
PORT = 8773
if HOST != "127.0.0.1":
raise SystemExit("refusing non-loopback bind")

LIMIT = 1
broken_n = 0
fixed_n = 0
lock = threading.Lock()

class Handler(BaseHTTPRequestHandler):
def log_message(self, fmt, *args):
    print("[demo]", fmt % args)

def _send(self, code: int, body: str):
    data = body.encode("utf-8")
    self.send_response(code)
    self.send_header("Content-Type", "text/plain; charset=utf-8")
    self.send_header("Content-Length", str(len(data)))
    self.end_headers()
    self.wfile.write(data)

def do_GET(self):
    global broken_n, fixed_n
    p = urlparse(self.path).path
    if p == "/broken/apply":
        n = broken_n
        time.sleep(0.08)
        if n < LIMIT:
            broken_n = n + 1
            return self._send(200, f"broken applied n={broken_n}")
        return self._send(409, f"broken denied n={broken_n}")
    if p == "/fixed/apply":
        with lock:
            if fixed_n < LIMIT:
                fixed_n += 1
                return self._send(200, f"fixed applied n={fixed_n}")
            return self._send(409, f"fixed denied n={fixed_n}")
    if p == "/reset":
        broken_n = 0
        fixed_n = 0
        return self._send(200, "reset")
    return self._send(
        200,
        "Cyberlium A06 counter toy. DEMO writeup: http://192.168.0.1/ "
        "GET /broken/apply  GET /fixed/apply  GET /reset  LIMIT=1",
    )

print("bind", HOST, PORT)
print("demo_writeup_url http://192.168.0.1/")
print("if 192.168.0.1 is a router, curl", f"http://{HOST}:{PORT}/")
ThreadingHTTPServer((HOST, PORT), Handler).serve_forever()
PY

cat > a06_l03_practical_commands.sh << 'SH'

wait

wait

SH

{

Race literacy without bank-steal kits: two requests, one limit, design must serialize truth — proven with DEMO/SAFE curls on 8773. A06 Insecure Design. Original Cyberlium — not official OWASP certification. Next — Lab — Design Review Note — pull threat model, logic, and race lines into one review on an app you own.