Lock server session when handling a request

irmaserver/backend/api.go

@@ -104,6 +104,8 @@ func HandleProtocolMessage(
 		status, output = responseJson(nil, getError(irmaserver.ErrorSessionUnknown, ""))
 		return
 	}
+	session.Lock()
+	defer session.Unlock()
 
 	// However we return, if the session has been finished or cancelled by any of the handlers
 	// then we should inform the user by returning a SessionResult - but only if we have not

irmaserver/backend/sessions.go

@@ -76,6 +76,7 @@ func (s memorySessionStore) deleteExpired() {
 	s.RLock()
 	expired := make([]string, 0, len(s.m))
 	for token, session := range s.m {
+		session.Lock()
 		if session.lastActive.Add(5 * time.Minute).Before(time.Now()) {
 			if !session.finished() {
 				conf.Logger.Infof("Session %s expired", token)
@@ -86,6 +87,7 @@ func (s memorySessionStore) deleteExpired() {
 				expired = append(expired, token)
 			}
 		}
+		session.Unlock()
 	}
 	s.RUnlock()