Wt

Normally, each Wt::Auth::OAuthRedirectEndpoint object will not receive multiple requests simultaneously. However, in rare cases (e.g. in case of connectivity issues), multiple redirects may be received simultaneously. This may result in a crash, as the Wt::Auth::OAuthRedirectEndpoint::handleRequest does not seem to be implemented in a thread safe manner. E.g. handleRequest calls OAuthProcess::requestToken, which destructed the previous Http::Client. Hence, while one thread is still executing the Http::Client::post method, another thread may already destruct the client.

Possible solutions

• Use proper locking while accessing the OAuthProcess object.
• Use setTakesUpdateLock to avoid concurrency issues. In the non-popup mode, this should be reasonable, but in case of a popup is used, locking the application may be undesired.