Skip to content

Incorrect request populated as context for mutation #56

Closed
graphql-python/graphql-core-legacy
#260
@maxlang

Description

@maxlang

I posted about this on stackoverflow, but figured I'd ask about it directly here as well: https://stackoverflow.com/questions/53233291/python-flask-and-graphene-incorrect-request-causes-security-issue

Basically, the issue is that when I try to perform a high volume of mutations as one user while another user is making requests as well, some number of those mutations are made as the wrong user.

The issue seems to go away when I run with gunicorn instead of FLASK_ENV=production flask run

I know the context is populated here: https://github.com/graphql-python/flask-graphql/blob/master/flask_graphql/graphqlview.py but the context for the query is incorrect in this case.

I was wondering if anyone had seen this issue before, or could point me in the right direction so I can figure out what's wrong.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions