Skip to content

SessionID generation conflicts with pre-existing SIDs

  • I have described the bug in complete detail in the Description section.
  • I have specified steps in the Reproduction section.
  • I have included the versions which are affected in the Version(s) section.

Description

When logging in (via /login), it has been observed that SessionID generation can create a non-unique SID. When this occurs, database exceptions are unhandled, causing an IntegrityError to be raised and a 500 to be returned from FastAPI.

Reproduction

To reproduce this bug, fill up the database with 32^16 combinations of SID strings, which fills up the Session table because we cannot produce any more unique SIDs (since it's full). After doing so, login. You will be presented with an IntegrityError when committing your new attempted SID generation to the database. From an HTML user standpoint; you'll get a 500.

Version(s)

Before 806a19b9

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information