id,summary,reporter,owner,description,type,status,component,version,severity,resolution,keywords,cc,stage,has_patch,needs_docs,needs_tests,needs_better_patch,easy,ui_ux 10470,Core handlers are not threadsafe,tdterry,tdterry,"I have found an incomplete-initialization bug the `WSGIHandler` when running under Apache mpm_worker with mod_wsgi. Code review shows this is a potential problem with all of the handlers. On the first request the `WSGIHandler.__call__(...)`, we set up the middleware. There is a lock wrapping the load of the middleware, but the logic still allows incomplete initialization on other threads. Below is the block of code in question from django/core/handlers/wsgi.py (line 226): {{{ if self._request_middleware is None: self.initLock.acquire() # Check that middleware is still uninitialised. if self._request_middleware is None: self.load_middleware() self.initLock.release() }}} Example: 1. Initial start or restart of the Apache instance 2. Thread T1 - a request comes in. `self._request_middleware` is `None` 3. Thread T1 - acquires the `self.initLock`, calls `self.load_middleware()` 4. Thread T2 - a request comes in (T1 is part of the way through `self.load_middleware()`) 5. Thread T2 - `self._request_middleware` is not `None`, but it's not completely loaded either, continues with the request 6. Thread T1 - completes `self.load_middleware()`, release the lock The attached patch changes `BaseHandler.load_middleware()` to do an atomic set of all four middleware lists. `self._request_middleware` is set last to signal the completion of middleware loading. ",,closed,Core (Other),1.0,,fixed,"wsgi, basehandler, mod_python, threadsafe, threading",,Accepted,1,0,0,0,0,0