Concurrency Check with Web API Not Checking - asp.net-mvc

Question

Using EntityFramework v6, I am putting together a prototype to demonstrate concurrency checking in a Web Api as well as in a desktop application.
Entity:
public static class IRowVersionExtensions
{
public static string RowVersionAsString(this IRowVersion ivr)
{
return Convert.ToBase64String(ivr.RowVersion);
}
public static void SetRowVersion(this IRowVersion ivr, string rowVersion)
{
ivr.RowVersion = Convert.FromBase64String(rowVersion);
}
}
public interface IRowVersion
{
byte[] RowVersion { get; set; }
}
public class Department : IRowVersion
{
[Key]
public int Id { get; set; }
[Required, MaxLength(255)]
public string Name { get; set; }
public string Description { get; set; }
[Timestamp]
[ConcurrencyCheck]
public byte[] RowVersion { get; set; }
}
DbContext:
public class CompDbContext : DbContextEx
{
public CompDbContext()
: base("Company")
{
this.Configuration.LazyLoadingEnabled = false;
}
public DbSet<Department> Departments { get; set; }
}
The desktop application (console app) has the following code, and throws a DbConcurrencyException as expected: http://pastebin.com/i6yAmVGc
Now, the API controller - when I open the page in two windows and edit one (and save) then try to edit/save the other, it does not throw an exception:
Api Controller Update Action:
[HttpPatch, Route("")]
public Department UpdateDepartment(Department changed)
{
var original = dbContext.Departments.Find(changed.Id);
if (original == null)
this.NotFound();
if (Convert.ToBase64String(changed.RowVersion) != Convert.ToBase64String(original.RowVersion))
Console.WriteLine("Should error.");
original.RowVersion = changed.RowVersion;
original.Name = changed.Name;
original.Description = changed.Description;
dbContext.SaveChanges();
return original;
}
Api Call:
DepartmentVM.prototype.onSave = function (entity) {
var method = entity.id() ? 'PATCH' : 'PUT';
$.ajax({
url: '/api/departments',
method: method,
data: ko.toJSON(entity),
contentType: 'application/json',
dataType: 'JSON'
})
.done(function (data) {
alert('Saved');
entity.rowVersion(data.rowVersion);
entity.id(data.id);
})
.error(function (data) {
alert('Unable to save changes to department.');
});
};
When I break on the line in the controller action:
if (Convert.ToBase64String(changed.RowVersion) != Convert.ToBase64String(original.RowVersion))
On the first save, the changed.RowVersion == original.RowVersion (perfect) and it saves (as expected). On the second page's save, the changed.RowVersion != original.RowVersion (perfect) but it still saves, no exception (not as expected).
Can some one help me understand why this works just fine in a desktop application but does not work in a Web API?

Answer 1

It's not working because EF uses the "original" value of RowVersion to perform the concurrency check. In your example, the original value (as far as the DbContext is concerned) is the value from the database, because it was loaded from the database using .Find().
Say, for example, the RowVersion of the changed entity is 1, and the current RowVersion in the database is 2...
// changed's RowVersion is 1
var original = dbContext.Departments.Find(changed.Id);
// original's RowVersion is 2
if (original == null)
this.NotFound();
if (Convert.ToBase64String(changed.RowVersion) != Convert.ToBase64String(original.RowVersion))
Console.WriteLine("Should error."); // 2 != 1, so prints this line
original.RowVersion = changed.RowVersion;
// original's "current" RowVersion is now 1
// ... but its "original" RowVersion is still 2!
original.Name = changed.Name;
original.Description = changed.Description;
dbContext.SaveChanges();
// UPDATE DEPT SET ... WHERE Id = ... AND RowVersion = 2
// (works, therefore no concurrency exception)
To make this work, you can just add the incoming entity to the context...
[HttpPatch, Route("")]
public Department UpdateDepartment(Department changed)
{
dbContext.Entry(changed).State = EntityState.Modified;
dbContext.SaveChanges();
// you'll get an exception if RowVersion has changed
return changed;
}
If you only want to change Name and Description, you can selectively mark those properties as changed and the rest are not updated...
[HttpPatch, Route("")]
public Department UpdateDepartment(Department changed)
{
dbContext.Entry(changed).State = EntityState.Unchanged;
dbContext.Entry(changed).Property(d => d.Name).IsModified = true;
dbContext.Entry(changed).Property(d => d.Description).IsModified = true;
dbContext.SaveChanges();
// you'll get an exception if RowVersion has changed
return changed;
}
The reason the console app worked was a bit lucky. There's a race condition in which if the Find() in t1 executes after the SaveChanges() in t2 (or vice versa), you'd run into the same situation.