User actions queue correctly during offline
Why it matters
When a user submits a form or triggers a mutation while offline and the app silently drops the request, data is lost without notice. This is both a trust failure and a functional defect. CWE-362 (Concurrent Execution Race Condition) applies when reconnect occurs mid-action without a serialized queue: the same action can fire multiple times or not at all. An offline action queue with local storage persistence ensures user intent is preserved across connectivity gaps, reconnects, and app restarts — a baseline requirement for any app used in variable-network environments.
Severity rationale
Medium because dropped offline mutations cause silent data loss, but the immediate impact is bounded to the current session rather than enabling cross-user exploitation.
Remediation
Implement a durable action queue in AsyncStorage. Enqueue every mutation when offline; drain the queue ordered by timestamp when connectivity returns.
const QUEUE_KEY = 'offline_queue';
export async function enqueue(action: unknown) {
const raw = await AsyncStorage.getItem(QUEUE_KEY);
const queue: unknown[] = raw ? JSON.parse(raw) : [];
queue.push({ id: `${Date.now()}-${Math.random()}`, action, retries: 0 });
await AsyncStorage.setItem(QUEUE_KEY, JSON.stringify(queue));
}
export async function drainQueue(execute: (a: unknown) => Promise<void>) {
const raw = await AsyncStorage.getItem(QUEUE_KEY);
if (!raw) return;
const queue = JSON.parse(raw) as Array<{ id: string; action: unknown; retries: number }>;
const failed: typeof queue = [];
for (const item of queue) {
try {
await execute(item.action);
} catch {
if (item.retries < 3) failed.push({ ...item, retries: item.retries + 1 });
}
}
await AsyncStorage.setItem(QUEUE_KEY, JSON.stringify(failed));
}
Call drainQueue inside your NetInfo listener on the offline→online transition (see data-sync-on-reconnect). Show a pending-actions badge in the UI so users know their changes are queued.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Mobile Offline & Storage Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-362 — Concurrent Execution Using Shared Resource with Improper Synchronization (Race Condition)
- iso-25010:2011 · reliability.recoverability — Recoverability
Taxons
History
- 2026-04-18·v1.0.0·Initial import from mobile-offline-storage·automated