← Engineering Logs

Tag

#idor

1 article

  1. One Seat, Two Buyers: Race Conditions, IDOR and Keys in a Cinema Booking System

    How BookMyMovie makes sure one cinema seat is never sold twice, a guessed booking number shows nothing, and a leaked or missing key can't quietly break tickets: row locks, lock order, a NULL-tolerant unique key, status compare-and-set, idempotency, IDOR scoping, HMAC tickets, captcha step-up, and the bugs that still got through.

    11 minThe Engineering Logs