Can multiple Custom Form submissions/requests overlap?

Topics: Troubleshooting
Jan 20, 2015 at 9:27 AM

We've got a bunch of Custom Forms on our site - they all work really well. But we've started to get heavy traffic to one form and have received a few complaints from users saying that when they initially arrive at the form it's already populated with someone else's details. It doesn't seem to be an 'autocomplete' problem - the details in the form are from people they don't know.

There isn't anything special about this form - there's no Workflow attached to it. It has Re Captcha and a few other fields. We save the data, redirect to another URL and display a message once the form has been submitted.

Is it possible that custom form requests and submissions can overlap? I mean if user 1 arrives at the page and Orchard is processing a form submission from user 2 could user 1 somehow get served up a form containing user 2's details?

We've tried to duplicate the problem without any luck. We've got a workaround in place - we're running some Javascript when the form loads to ensure that the fields are empty. But maybe we're doing something fundamentally dumb or someone has some clever ideas as to why this might (or might not) be happening?

Thanks a lot.
Jan 21, 2015 at 6:30 PM
This is not something remotely normal... What do you have as the server setup? Web farm?

This is a shot into the dark, but a Custom Form can only be pre-filled with data (otherwise than deliberately doing it through content events) if you post it but get a validation error back with your data already in the form. Now as you can check in Orchard.CustomForms.Controllers.ItemController ln 140 such a case will result in the invalid form's editor (including data populated) saved to TempData, which is then retrieved in Views\Parts.CustomForm.Wrapper.cshtml.

TempData uses sessions in the background by default. It seems your uses are getting the session of other users...

If indeed you're running your site on multiple servers you can either use sticky sessions or a different TempData provider that doesn't utilize sessions.
Jan 27, 2015 at 8:13 PM
Thanks for your reply @Piedone.

No, no web farm - just a single server. Thanks for your thoughts and ideas about sticky sessions/changing TempData providers. They both sound like good options - we'll have a look at implementing one of those. Thanks again.
Jan 27, 2015 at 9:08 PM
Hmm. I'd encourage you to still check if there can be any issues with sessions. At least I can see no other option from the code for what you describe to happen than by sessions being mixed up.
Jan 28, 2015 at 9:16 AM
Thank you - yeah true - we'll do that first. We've actually been trying to reproduce the issue by hammering the site with 2 different load tests and seeing if either of their form posts result in overlapping data. But so far no luck. We're also trying to extract more information from the users that complained - but they were a bit upset so may not be too forthcoming! But if they could confirm they also got a validation error as well as someone else's data that would be a helpful clue.

And certainly what you explain about a validation error being returned to the wrong user makes lots of sense so we'll pursue that first.