Testing for Race Conditions (OWASP-AT-010)

Brief Summary
A race condition is a flaw that produces an unexpected result when timing of actions impact other actions. An example may be seen on a multithreaded application where actions are being performed on the same data. Race conditions, by their very nature, are difficult to test for.

Description of the Issue
Race conditions may occur when a process is critically or unexpectedly dependent on the sequence or timings of other events. In a web application environment, where multiple requests can be processed at a given time, developers may leave concurrency to be handled by the framework, server or programming language. The following example describes a potential concurrency problem in a transactional web application.


 * EXAMPLE