Thread unsafe current_user usage in Auth::DefaultCurrentUserProvider

[bjfish (Brandon Fish)]

I believe there is a thread unsafe usage of a model instance where it appears to be sent to another thread here and later accessed concurrently:

lib/auth/default_current_user_provider.rb

Please review this thread which discusses the issue and a possible fix:

Update ActiveModel::AttributeSet::Builder to use Concurrent::Map

[sam (Sam Saffron)]

I see …

Something like this I guess:

FIX: avoid concurrent usage of AR models

@daniel / @david / @tgxworld ?

It adds a new “find” query once a minute, but I guess this is acceptable since it will not happen every single request. I kept the old interface in place.

Can not easily be tuned further without breaking the plugin interface which would be a bit of a nightmare.