Bug Description
The backend uses global variables (LAST_IP_LAT, LAST_IP_LON, IP_FETCHED) with the global keyword for caching user location. This is not thread-safe in FastAPI's asynchronous environment.
Location
backend/routers/medicines.py (lines 10-27)
Current Code
LAST_IP_LAT = 18.5204
LAST_IP_LON = 73.8567
IP_FETCHED = False
def get_default_location():
global LAST_IP_LAT, LAST_IP_LON, IP_FETCHED
if IP_FETCHED:
return LAST_IP_LAT, LAST_IP_LON
try:
# ... fetch location ...
IP_FETCHED = True
return LAST_IP_LAT, LAST_IP_LON
except Exception:
return 18.5204, 73.8567Problem
FastAPI handles concurrent requests asynchronously. Global variables modified with global keyword can cause:
- Race conditions
- Inconsistent state between requests
- Potential security issues (one user getting another user's location)
Suggested Fix
Use one of these approaches:
- FastAPI's app state:
request.app.state.last_ip_lat
functools.lru_cache for the location fetch function- A proper caching solution (Redis, etc.)
Impact
- Race conditions under concurrent requests
- Potential data leakage between users
- Unreliable location caching
Labels
bug, backend, security, help wanted
Bug Description
The backend uses global variables (
LAST_IP_LAT,LAST_IP_LON,IP_FETCHED) with theglobalkeyword for caching user location. This is not thread-safe in FastAPI's asynchronous environment.Location
backend/routers/medicines.py(lines 10-27)Current Code
Problem
FastAPI handles concurrent requests asynchronously. Global variables modified with
globalkeyword can cause:Suggested Fix
Use one of these approaches:
request.app.state.last_ip_latfunctools.lru_cachefor the location fetch functionImpact
Labels
bug, backend, security, help wanted