Time of check time of use (TOCTOU)

  2026-05-30

  Edited: 2026-05-30

I was wondering if there was a name for something where you check for permissions and then afterwards execute some action

if !user.has_role(role):
    return False

if !user.has_permission(perm):
    return False

return do_something(...)

Turns there is and it is call TOCTOU (time of check, time of use). It is technically a vulnerability and you can use database transactions to resolve this. But transactions have a price, and that is speed. Generally, the solution is really open and depends on what you want. Like does it matter if someone can read a specific resource a just as they have lost permissions for for it? So it is a discussion on trade-offs.

References:

]]- stackexchange discussion