Understanding and detecting server-side request races in web applications

Modern web sites often run web applications on the server to handle HTTP requests from users and generate dynamic responses. Due to their concurrent nature, web applications are vulnerable to serverside request races. The problem becomes more severe with the ever-increasing popularity of web applications.

We first conduct a comprehensive characteristic study of 157 realworld server-side request races collected from different, popular types of web applications. The findings of this study can provide guidance for future development support in combating server-side request races.

Guided by our study results, we develop a dynamic framework, ReqRacer, for detecting and exposing server-side request races in web applications. We propose novel approaches to model happensbefore relationships between HTTP requests, which are essential to web applications. Our evaluation shows that ReqRacer can effectively and efficiently detect known and unknown request races.

• Software and its engineering → Software defect analysis; Software reliability; Software testing and debugging; Concurrency control; Organizing principles for web applications; Consistency.