Body:
The _get_nonce method in AuthProvider.py attempts to generate a unique nonce based on the current time. While it uses a lock to prevent concurrent access, the logic might still generate duplicate nonces under heavy load, especially if the system clock resolution is low. The code increments the nonce by 1 only if the new nonce is less than or equal to the last nonce. However, if multiple threads call _get_nonce simultaneously and obtain the same new_nonce value before any thread has updated self.last_nonce, multiple threads might increment new_nonce to the same value.
Recommendation:
- Use a monotonically increasing counter instead of relying on
time.time(). A simple integer counter, protected by the nonce_lock, would be a more reliable source of unique nonces.