Challenge 12/36: Race Condition Coupon Abuse - Trusting the Client

Challenge 12/36 · Trusting the Client. Race condition coupon abuse. Hard · Insecure Design · 45–90 min. OopsSec Store validates a coupon and increments its counter in two separate database calls. Send enough concurrent requests and several slip through the check before any of them completes the increment. Spin up the lab: npx create-oss-store my-ctf-lab. See it on the roadmap: https://koadt.github.io/oss-oopssec-store/roadmap#challenge-12. Walkthrough: https://koadt.github.io/oss-oopssec-store/posts/race-condition-coupon-abuse — spoilers, read it once you are stuck. Star OopsSec Store on GitHub: https://github.com/kOaDT/oss-oopssec-store