Many real-world web applications “shockingly” don’t guarantee ACID-style transactional state updates, and thus are vulnerable to race conditions. Suppose (for

Many real-world web applications “shockingly” don’t guarantee ACID-style transactional state updates, and thus are vulnerable to race conditions. Suppose (for instance) that the application tier caches user session information by some internal, reused ID. If that state is updated transactionally, with an ID assigned to a new session atomically with the insertion of that new session’s data, no problem. But if the session is assigned a previously used ID a few microseconds before the new session’s data is populated, a racing request could see the old data from a different user.