Redis Session locking makes add to cart action very slow and cpu spikes

[ioweb-gr]

Preconditions and environment

• Magento version 2.4.8
• Use redis sessions and set disable_locking = 0

Steps to reproduce

1. Create a profile with 10000 simple products in a category
2. Visit the category
3. Set pagination to something like 50 so that you can easily do the test
4. Start adding the products to cart one by one in sequence without waiting

You will notice lots of profile recordings like this

First of all the speed of adding to cart shouldn't be affected so hard.

Secondly as a side-effect, while this is occuring the php-fpm requests are hanging in the CPU occupying fpm children and leading to the cores being fully utilized preventing other operations from occurring.

When this happens in bulk , e.g. from spiders like META, Google , Bytedance etc etc the load on a server can go really high.

Expected result

Add to cart is processed normally

For example if we disable locking

Actual result

The add-to-cart action slows down a lot and especially the more products we have to the cart it increases further

Additional information

No response

Release note

No response

Triage and priority

• Severity: S0 - Affects critical data or functionality and leaves users without workaround.
• Severity: S1 - Affects critical data or functionality and forces users to employ a workaround.
• Severity: S2 - Affects non-critical data or functionality and forces users to employ a workaround.
• Severity: S3 - Affects non-critical data or functionality and does not force users to employ a workaround.
• Severity: S4 - Affects aesthetics, professional look and feel, “quality” or “usability”.

[m2-assistant]

Hi @ioweb-gr. Thank you for your report.
To speed up processing of this issue, make sure that the issue is reproducible on the vanilla Magento instance following Steps to reproduce.

• For more details, review the Magento Contributor Assistant documentation.
• Add a comment to assign the issue: @magento I am working on this
• To learn more about issue processing workflow, refer to the Code Contributions.

---

Join Magento Community Engineering Slack and ask your questions in #github channel.
⚠️ According to the Magento Contribution requirements, all issues must go through the Community Contributions Triage process. Community Contributions Triage is a public meeting.
🕙 You can find the schedule on the Magento Community Calendar page.
📞 The triage of issues happens in the queue order. If you want to speed up the delivery of your contribution, join the Community Contributions Triage session to discuss the appropriate ticket.

[engcom-Hotel]

Hello @ioweb-gr,

Thanks for the report and collaboration!

We have tried to reproduce this issue in the latest 2.4-develop branch and 2.4.8 vanilla instance but it seems the issue is not reproducible for us. We have followed the below steps to reproduce the issue:

1. Enable redis session via the below command:
   bin/magento setup:config:set --session-save=redis --session-save-redis-host=127.0.0.1 --session-save-redis-log-level=4 --session-save-redis-db=2 --session-save-redis-disable-locking=1

2. Please refer to the below screenshot from the app/etc/env.php file:

3. Ran performance toolkit to install the 10k simple products:

4. For us when we starts adding product into the cart, the request has been completed in the milleseconds. Please refer to the below screencast for the same:

Category-1.webm

Please let us know if we missed anything.

Thanks

[m2-assistant]

Hi @engcom-Hotel. Thank you for working on this issue.
In order to make sure that issue has enough information and ready for development, please read and check the following instruction: 👇

• 1. Verify that issue has all the required information. (Preconditions, Steps to reproduce, Expected result, Actual result).
• 2. Verify that issue has a meaningful description and provides enough information to reproduce the issue.
• 3. Add Area: XXXXX label to the ticket, indicating the functional areas it may be related to.
• 4. Verify that the issue is reproducible on 2.4-develop branch
  Details

  - If the issue is reproducible on 2.4-develop branch, please, add the label Reproduced on 2.4.x.
  - If the issue is not reproducible, add your comment that issue is not reproducible and close the issue and stop verification process here!
• 5. Add label Issue: Confirmed once verification is complete.
• 6. Make sure that automatic system confirms that report has been added to the backlog.

[ioweb-gr]

In your install command you have set disable-locking=1 not 0 that's why it's not replicating

Please set disable-locking to 0 and retry

[engcom-Hotel]

Hello @ioweb-gr,

We have made the disable-locking as 0 and try to reproduce the issue again, and added almost 71 products to the cart. But the issue is still not reproducible for us.

Please refer to the below screencast:

1-min.mp4

Let us know if we missed anything.

Thanks

[ioweb-gr]

OK I checked your video. It seems you're adding the item , pausing until it's added, adding the item, pausing until it's added etc etc.

Try it without pausing in between pressing add to cart button and check the network waterfall in the inspector. Only then will locking take place for a really long period while still occupying the php-fpm processes

[engcom-Hotel]

Hello @ioweb-gr,

Thanks for the reply!

But still we are unable to reproduce the issue. Can you please share some screencast, it helps us in issue reproduction?

Thanks

[ioweb-gr]

Here's an example with a simplified way to reproduce it

Add a few products in your cart and then visit the category page.

On the console tab write this command to simultaneously click on all add to cart buttons

document.querySelectorAll('.action.tocart.primary').forEach(el => el.click());

firefox_i8HKewAisp.mp4

Watch the network tab after filtering for cart/add

You will notice the duration fluctuates due to session locking

The problem comes because nowdays this can be spammed a lot by a lot of automated tools bringing down the whole server. I've seen loads spike up to 500 on a 48 core machine because someone is spamming add to cart button.

That's effectively a DoS attack by just clicking add to cart button

[engcom-Hotel]

Hello @ioweb-gr,

Thanks for more information on this issue. We are able to reproduce this issue now in the 2.4-develop branch. Please refer to the below screenshot for the reference:

Hence confirming the issue.

Thanks

[github-jira-sync-bot]

✅ Jira issue https://jira.corp.adobe.com/browse/AC-14609 is successfully created for this GitHub issue.

[m2-assistant]

✅ Confirmed by @engcom-Hotel. Thank you for verifying the issue.
Issue Available: @engcom-Hotel, You will be automatically unassigned. Contributors/Maintainers can claim this issue to continue. To reclaim and continue work, reassign the ticket to yourself.