Express.js Request Isolation

Question

I have a Node.js Express app where multiple users make requests to the server to earn points, change their email address, interact with other users, etc.

My server code uses quite a few setTimeouts and I am wondering if it is possible for different users requests to corrupt each other.

EDIT: Here's a better example:

I have this code:

app.post('/webhooks/email', function (req, res, next) {
    var storeRequestInDataBase = function(req, res, next) {Writes Request Data To Database};
    setTimeout(storeRequestInDataBase, 10000, req, res, next);
    res.send(200, 'Message Received');
});

Now, if I am getting 10 requests a second from different users, the requests from other users come BEFORE the setTimeout for the first user. So, I am wondering if there is ever a scoping risk where the last request is what is processed by the setTimeout for the first user.

I have tested this and things seem to work, but I am concerned about corner cases.

Answer 1

Since Node is single threaded, only one thread of execution is run at a time. Any I/O, or in this case, a setTimeout, will push the processing of that code onto a stack so that Node can continue to process other things (often from this event loop). A setTimeout sets a timer which, once the time expires, will then place the function to be run on the stack. So if someone was to make a request prior to that timer expiring, then their request would be processed first.

So yes, the processing of the two requests would be intertwined. I would suggest you somehow register within your code base (or perhaps your database) that the first request was for that email address so the next one does not try to register the same.

Answer 2

I'm late to the fun, but I recently encountered a similar scenario to what is being asked in this original question, and feel the provided answer requires some clarification.

Revisiting the code sample:

app.post('/webhooks/email', function (req, res, next) {
    var storeRequestInDataBase = function(req, res, next) {Writes Request Data To Database};
    setTimeout(storeRequestInDataBase, 10000, req, res, next);
    res.send(200, 'Message Received');
});

Since the storeRequestInDataBase variable is redefined to a new function each time a request is made to /webhooks/email , it is that newly defined function that will get processed. You are not changing the function that setTimeout will call after its timer completes, and because all previous requests were queued up for execution sequentially, they will get fired sequentially. I believe your code is risk free in terms of scoping the behavior of individual requests. So long as the results of database operations handled by previous requests do not impact future requests, you're good to go.