Race / TOCTOU
If it should happen once, send it twice in one RTT.
Tags: race, toctou, limit
Checklist
- Pick a unique action: Coupon, invite, MFA confirm, transfer, claim username, redeem credit.
- Two sessions you own: Do not race other customers. Parallelize from two cookies or HTTP/2 streams.
- Single-packet: HTTP/2 Turbo Intruder / last-byte sync so the lock cannot increment between requests.
- Measure: Both 200? Extra credit remaining? Two rows in the DB? Screenshot plus IDs.
- Idempotency keys: If the API has Idempotency-Key, send the same key and different keys. Both are tests.
- Cleanup: Revert coupons, invites, extra credits. Do not leave a production limit broken.