Limit and uniqueness races
If it should happen once, send it twice in one RTT. Two sessions you own.
Tags: race, toctou, limit
Techniques
HTTP/2 single-packet
Turbo Intruder last-byte sync or two streams. Serial HTTP/1 is not the test.
N parallel POST /redeem with the same coupon on an account you own
Idempotency-Key
Same key twice vs two keys. Both behaviours are in scope to document.
Idempotency-Key: A on two bodiestwo different keys on the same action
Enable vs disable
MFA or 2FA enable racing disable, or email-confirm racing session issue.
parallel enable-mfa and disable-mfa from two cookies you own