Race conditions and TOCTOU: the window between check and use

A race condition arises when two concurrent operations act on the same state and the result depends on ordering. Time-Of-Check to Time-Of-Use: you verify a condition, but between the check and the use something changes.

The attack

Send many requests in parallel at the right instant (single-packet attack to align arrival). Examples: redeeming a coupon N times because all requests see "not yet used"; withdrawing more than the balance because the checks read the same value before the update.

# 20 simultaneous requests to /redeem?code=X
# all pass the "valid and unused" check before the decrement

Defence

Make the check-then-act sequence atomic: transactions with locks (SELECT ... FOR UPDATE), atomic DB operations (conditional decrement UPDATE ... WHERE balance >= n), uniqueness constraints, or distributed locks. Idempotency on sensitive operations.