# Thread unsafe current\_user usage in Auth::DefaultCurrentUserProvider

**URL:** https://meta.discourse.org/t/thread-unsafe-current-user-usage-in-auth-defaultcurrentuserprovider/225671
**Category:** Bug
**Created:** [April 29, 2022, 2:26pm UTC](https://meta.discourse.org/t/thread-unsafe-current-user-usage-in-auth-defaultcurrentuserprovider/225671 "2022-04-29T14:26:21Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![bjfish](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/bjfish/32/188318_2.png) [@bjfish](https://meta.discourse.org/u/bjfish)
#### Post date: [April 29, 2022, 2:26pm UTC](https://meta.discourse.org/t/thread-unsafe-current-user-usage-in-auth-defaultcurrentuserprovider/225671/1 "2022-04-29T14:26:21Z")

</div>

I believe there is a thread unsafe usage of a model instance where it appears to be sent to another thread here and later accessed concurrently:

> <https://github.com/discourse/discourse/blob/c88ca23e8f657de747a5ad864978970f1bd3fa56/lib/auth/default_current_user_provider.rb#L223-L226>

Please review this thread which discusses the issue and a possible fix:  
[https://github.com/rails/rails/pull/44977](https://github.com/rails/rails/pull/44977)

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [May 2, 2022, 7:28am UTC](https://meta.discourse.org/t/thread-unsafe-current-user-usage-in-auth-defaultcurrentuserprovider/225671/2 "2022-05-02T07:28:14Z")

</div>

I see …

Something like this I guess:

[https://github.com/discourse/discourse/pull/16596](https://github.com/discourse/discourse/pull/16596)

@daniel / @david / @tgxworld ?

It adds a new “find” query once a minute, but I guess this is acceptable since it will not happen every single request. I kept the old interface in place.

Can not easily be tuned further without breaking the plugin interface which would be a bit of a nightmare.

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [June 20, 2022, 9:10pm UTC](https://meta.discourse.org/t/thread-unsafe-current-user-usage-in-auth-defaultcurrentuserprovider/225671/4 "2022-06-20T21:10:19Z")

</div>


