Skip to content

Race condition in create_certificate allows duplicate certificates per user per course #2408

@cap-code

Description

@cap-code

Describe the bug
The create_certificate API endpoint is vulnerable to a race condition that allows duplicate certificates to be created for the same user and course. When a user clicks the "Get Certificate" button multiple times in quick succession, multiple parallel requests pass both the is_certified() check and the validate_duplicate_certificate() validation before any of them commit to the database, resulting in duplicate LMS Certificate records.

This inflates the certification count reported by get_chart_details and creates orphan certificate records.
To Reproduce
Steps to reproduce the behavior:

  1. Go to a course with enable_certification enabled
  2. Complete the course (progress = 100%)
  3. Click the "Get Certificate" button rapidly multiple times (3-5 clicks within 1-2 seconds)
  4. Check LMS Certificate list — multiple duplicate certificates are created for the same user and course

Expected behavior
Only one certificate should be created per user per course, regardless of how many times the button is clicked. Subsequent clicks should return the existing certificate (as is_certified() intends) rather than creating duplicates.

Desktop (please complete the following information):

  • OS: Ubuntu 22.04
  • Browser: Chrome 136
  • Version: Frappe LMS v2.54.1

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions