Updating a resource on distant server results in a 409

[thierry2015]

• Laravel Version: 5.7.15
• Nova Version: 1.1.7
• PHP Version: 7.2.12

Description:

When updating a resource that was recently created (about a minute ago), I keep having the same updating error message:

Another user has updated this resource since this page was loaded. Please refresh the page and try again.

The resource was retrieved at 1543891456 and last updated at 1543891576 (2 min after)
I was the only user editing the resource.

Since the retrieved_at time is the browser's Date() time and the updated_at is the server timestamp, there is a possibility of a mismatch if the client and the server are not well synced. This might also happen if updating on a different timezone.

Steps To Reproduce:

1. Have a distant server with a fresh Laravel w/ nova application, with a resource using the updated_at column.
2. Change the client time to make it 2 minutes earlier than the server
3. Update a resource
4. Edit the same resource again
5. Update it again
6. The error should appear on save (HTTP 409 w/ an error toast)

[Etmolf]

Since the retrieved_at time is the browser's Date() time

Wouldn't it be possible to retrieve the time as part of the response from the server?

[thierry2015]

Since the retrieved_at time is the browser's Date() time

Wouldn't it be possible to retrieve the time as part of the response from the server?

That's what I think that would be appropriate too. This is basically a server security feature and shouldn't rely on the client to provide such data. The initial response should indeed contains the retrieved_at

[gvsrepins]

Any update on this issue? Did you manage to solve it?

[SebastianMueller87]

We ran into the same problem.

Some clients are not able to configure their system time correctly.

In theory the current implementation also does not really prevent data from getting overwritten.

Example:
Client A and B make a request at the same time, let's say 11:59:01.

Client A's connection and system is much faster than Client B's. So he gets the response and initializes the component at 12:00:00 (= _retrieved_at). He edits something and saves it. The updated_at time (stored in the database) will be 12:00:01.

Client B gets the response much later than Client A, let's say at 12:00:02. Client B edits the data and saves it. The Server will compare Client B's _retrieved_at (12:00:02) with the updated_at (12:00:01). The storage process would succeed and Client A's changes would be lost.

Solution
A good solution would be to send the updated_at-timestamp (from the database) to the client and later on back to the server. A comparison of the updated_at time of the database with the retrieved updated_at time by the client would really prevent data from getting overwritten.

The best solution would be to use an hash over the current stored data instead of the updated_at-date. That approach would also observe manual database changes.

Related Issues: #601, #838, #1004

[thierry2015]

@SebastianMueller87 The hash solution would indeed be the best to implement in my opinion

[krns]

One argument against the hash solution is, when some resources don't implement all database fields as nova fields, because some fields are handled (set and updated) by the system.

For example a scheduled job could set a status field behind the scenes, when some conditions are true. When using received_at and updated_at, the job can update the database without touching the timestamps and everything works.. when using a hash over all stored data, this is not possible anymore.

A solution would be to use a hash over all database fields that are correspond to a nova field.

[bajramemini]

Here is my solution for now:

I have only one Admin and don't want to check if the model has been updated since retrieval.

1. Create your own Controller that extends Laravel\Nova\Http\Controllers\ResourceUpdateController like this:

<?php
namespace App\Http\Controllers\Nova;

use Laravel\Nova\Http\Requests\UpdateResourceRequest;
use Laravel\Nova\Http\Controllers\ResourceUpdateController as NovaResourceUpdateController;

class ResourceUpdateController extends NovaResourceUpdateController
{
    /**
     * Determine if the model has been updated since it was retrieved.
     *
     * @param  \Laravel\Nova\Http\Requests\UpdateResourceRequest $request
     * @param  \Illuminate\Database\Eloquent\Model               $model
     * @return bool
     */
    protected function modelHasBeenUpdatedSinceRetrieval(UpdateResourceRequest $request, $model)
    {
        return false;
    }
}

This controller always returns false, so the update function can proceed properly.

2. Add the binding to the register() method of the App\Providers\AppServiceprovider

/**
     * Register any application services.
     *
     * @return void
     */
    public function register()
    {
        $this->app->bind('Laravel\Nova\Http\Controllers\ResourceUpdateController', 'App\Http\Controllers\Nova\ResourceUpdateController');

    }

This will bind the Controller, use our own implementation which extends the Nova ResourceUpdateController.

This is my solution for now. Don't use it if you have a lot users in the backend, but in my case with only 1 Admin, this solves my problem.

Related Issues: #601, #838, #1004

Regards

[arku31]

@bajramemini Thanks for sharing your solution :) I would only suggest to bind it in the NovaServiceProvider instead of AppServiceProvider

[dmitrybubyakin]

@thierry2015 @SebastianMueller87 @Etmolf There is a way how to retrieve the time from the server.

Add this middleware to nova.middleware:

[
    <...>
    'middleware' => [
        <...>
        \App\Http\Middleware\Nova\RetrievedAtFromServer::class,
    ],
]

class RetrievedAtFromServer
{
    public function handle($request, Closure $next)
    {
        if ($request->has('_retrieved_at')) {
            $request->merge(['_retrieved_at' => $request->input('_server_retrieved_at')]);
        }


        return $next($request);
    }
}

Next in your App\Nova\Resource:

public function availableFields(NovaRequest $request)
{
    return parent::availableFields($request)->push(
        new class ('Server Retrieved At', '_server_retrieved_at') extends \Laravel\Nova\Fields\Text {
            public function resolve($resource, $attribute = null)
            {
                $this->value = (new DateTime)->getTimestamp();
            }

            protected function fillAttributeFromRequest(NovaRequest $request, $requestAttribute, $model, $attribute)
            {
            }
        }
    );
}

And also we need make this field hidden in the form. Maybe display: none.

[mislam]

This is happening when I wait little bit then press update. If I quickly click update within 3-4 seconds, then it updates without any problem. This is a severe issue for us as it significantly slows down our daily business. Need a fix ASAP.

[jbrooksuk]

This issue relates to an unsupported version of Nova. If you're still experiencing this in the latest version of Nova, please open a new ticket, thanks!

[SebastianMueller87]

This issue is not fixed. I will reproduce it in version 2.0.9 an open new ticket.

Just to repeat myself:

The current implementation does not really prevent data to getting overwritten.

[PKuebler]

@SebastianMueller87 thank you.