Certain user actions in the web interface may trigger many concurrent requests at the same time or at very small time intervals apart. When the CAS ticket has expired, this leads to 2 problems:

• their will be a race condition as to which request will recover with which ticket. This problem is minor per se.
• there will be another race condition for setting the "cas-location" cookie, meaning that one request might end up executing the other one after both have authenticated successfully.

One possible possible solution would be to identify the "cas-location" cookie with a unique serial number which would be passed back in the CAS fallback request.