Echo context leaking information across requests

[nikunjbadjatya]

Hi.
I am using echo version v4.1.0.
Observing that in an http request, information which is set in echo context using echo.Context.Set() and retrieved back using echo.Context.Get() in the same http request, across middlewares, is found to have leaking information from different requests.

The .Get() method is giving back data which was .Set() in some other http request.
Looked around for similar issue and found this link #273 which says the echo context was made concurrent safe in #1158
But the issue still coming.

I do not have a publicly shareable code yet but it is doing the following:

• start logger
• calls echo's 'requestid' middleware.
• custommiddleware1: does a c.Set("customerID", uniqueint). This uniquecustomerid is logged in a log file alongwith the requestid set above.
• custommiddleware2: does a c.Get("customerID") and logs it alongwith the requestid set above. This is logging customer ID which was set in some other request.

This is seen only under high load and reproduction is not trivial.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[jskrepnek]

@nikunjbadjatya Did this go anywhere for you?

[aldas]

Context is reset at the beginning of the request (inside ServeHTTP) here:

echo/echo.go

Line 645 in c32fafa

c.Reset(r, w)

context.Reset clears store here (used by c.Get / c.Set):

echo/context.go

Line 648 in c32fafa

c.store = nil

Possible explanation how context could leak is if you are using coroutines and pass echo.context out of the coroutine handling current request. In that situation echo puts back to pool and could hand/reuse it out to other subsequent request.

anyway - if it is coroutines doing background work for request - do not pass whole context to coroutine - extract what you need from context and use them.

For example underlying Request and Response that context holds are not coroutine-safe. If you create coroutines inside of you middleware-chain or in handler and manage to return request back to context before those new coroutines end and happen to have stored reference to Response inside coroutine - you are in world of hurt. Your coroutine is still assuming it is handling old request but the same Response instance is already resetted to handle new request by echo.ServeHTTP

TLDR:

• I doubt it is possible to share c.Get/c.Set between different request
• It is possible to share c.Response between different request when you create coroutines that outlive original request