make quick connect authorize atomic and stop the fallback shadowing redis

2026-09-24 23:38:35 +10:00
parent ba4d487c65
commit 6c54a02240
10 changed files with 819 additions and 50 deletions
@@ -147,6 +147,12 @@ namespace Emby.Server.Implementations.QuickConnect
            // Change the time on the request so it expires one minute into the future. It can't expire immediately as otherwise some clients wouldn't ever see that they have been authenticated.
            result.DateAdded = DateTime.UtcNow.Add(TimeSpan.FromMinutes(1));

+            // The guard above is a read on shared state, so it cannot settle a race between instances; the claim can.
+            if (!await _store.TryClaimAuthorizationAsync(result.Secret, ExpiryOf(result)).ConfigureAwait(false))
+            {
+                throw new InvalidOperationException("Request is already authorized");
+            }
+
            var authenticationResult = await _sessionManager.AuthenticateDirect(new AuthenticationRequest
            {
                UserId = userId,