#idor

One Seat, Two Buyers: Race Conditions, IDOR and Keys in a Cinema Booking System

How BookMyMovie makes sure one cinema seat is never sold twice, a guessed booking number shows nothing, and a leaked or missing key can't quietly break tickets: row locks, lock order, a NULL-tolerant unique key, status compare-and-set, idempotency, IDOR scoping, HMAC tickets, captcha step-up, and the bugs that still got through.

Sep 29, 202611 minThe Engineering Logs