iOS clients sending parallel duplicate requests - ios

Question

I have a situation where users are sending multiple parallel requests in a very short time frame, both GET and POST requests. We have a healthy mix of user agents, but only iOS clients are causing the duplication. It seems that the User Agent is non-standard. I tried to find browsers with similar user agents, and the only one I could find is Ghostery (which hides the browser/version), but I can't replicate the behaviour observed. Here's a list of user agent strings collected over the last week or so:
Mozilla/5.0 (iPhone; CPU iPhone OS 9_3_2 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Mobile/13F69
Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Mobile/14E304
Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_2 like Mac OS X) AppleWebKit/603.2.4 (KHTML, like Gecko) Mobile/14F89
Mozilla/5.0 (iPhone; CPU iPhone OS 10_3 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Mobile/14E277
Mozilla/5.0 (iPhone; CPU iPhone OS 9_1 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Mobile/13B143
As mentioned, these can produce parallel requests, even including when the requests result in 302 redirects, each redirect is followed. We usually notice this behaviour because we'll get database integrity errors due to attempts to create users with duplicated usernames, obviously since one of the parallel requests is successful, and the other fails. One of the most complex examples would be this string of requests from our apache log:
[19/May/2017:12:18:01 +0000] "GET /product/1/ HTTP/1.0" 200
[19/May/2017:12:18:12 +0000] "POST /product/1/ HTTP/1.0" 302
[19/May/2017:12:18:12 +0000] "GET /en/queue/buy/1862/ HTTP/1.0" 302
[19/May/2017:12:18:12 +0000] "GET /en/queue/buy/1862/ HTTP/1.0" 302
[19/May/2017:12:18:12 +0000] "GET /queue/buy/1862/ HTTP/1.0" 302
[19/May/2017:12:18:12 +0000] "GET /en/queue/buy/1862/ HTTP/1.0" 302
[19/May/2017:12:18:12 +0000] "GET /queue/buy/1862/ HTTP/1.0" 302
[19/May/2017:12:18:12 +0000] "GET /queue/buy/1862/ HTTP/1.0" 302
[19/May/2017:12:18:12 +0000] "GET /queue/buy/1862/ HTTP/1.0" 500
[19/May/2017:12:18:12 +0000] "GET /en/purchasing/buy/ HTTP/1.0" 302
[19/May/2017:12:18:12 +0000] "GET /en/purchasing/buy/ HTTP/1.0" 302
[19/May/2017:12:18:12 +0000] "GET /en/purchasing/buy/ HTTP/1.0" 302
[19/May/2017:12:18:12 +0000] "GET /purchasing/buy/ HTTP/1.0" 302
[19/May/2017:12:18:12 +0000] "GET /purchasing/buy/ HTTP/1.0" 302
[19/May/2017:12:18:12 +0000] "GET /purchasing/buy/ HTTP/1.0" 302
[19/May/2017:12:18:13 +0000] "GET /purchasing/orders/ HTTP/1.0" 200
[19/May/2017:12:18:13 +0000] "GET /purchasing/orders/ HTTP/1.0" 200
[19/May/2017:12:18:13 +0000] "GET /purchasing/orders/ HTTP/1.0" 200
The start of this flow would require the user to press a Buy button, which includes JS to disable the button on click, to reduce the chance of double-clicks. The form itself doesn't load without JS enabled, so we can be sure that JS is enabled on the browser.
Notice that the gap between the requests is virtually non-existent, and there are actually 4 parallel requests initially. One of them hits an HTTP 500 response, however 3 of the parallel requests return 302 and all appear to be followed all the way through to the final 200 response.
In this instance the user proceeded to complete their purchase legitimately, so I don't think any funny business ensued.
So I'm really unsure of how to handle this problem. I'm guessing I simply need to accept that this can happen with iOS clients. But I can't replicate the issue and I'm worried it might lead to a bad user experience in some cases.
Update
I updated the request list to include the initial entry point of the GET to load the form, and POST where it was submitted. Note only a single POST was received in this instance, yet, the redirect seems to have been followed 4 times.
Here's the HTML / JS involved in the initial submit:
HTML:
<form method="post" action="/product/1/" id="buy_form">
...
<button type="submit" id="buy_btn">Buy Now</button>
</form>
JS:
$("#buy_form").submit(function(){
$("#buy_btn").prop('disabled', true);
});