AWS iot documentation change
Summary
Added clarification about LWT message dispatch ordering during reconnection and recommended using lifecycle events for connectivity state detection
Security assessment
The change addresses potential reliability issues with message ordering but does not fix a specific vulnerability. The recommendation to use lifecycle events improves state tracking accuracy, which could help prevent security issues stemming from incorrect connectivity assumptions.
Diff
diff --git a/iot/latest/developerguide/mqtt.md b/iot/latest/developerguide/mqtt.md index c7d87d02a..d5088377f 100644 --- a//iot/latest/developerguide/mqtt.md +++ b//iot/latest/developerguide/mqtt.md @@ -384 +384 @@ When managing client connections, you can control whether LWT messages are publi -The broker will store the Will Messages until an uninitiated disconnection occurs. When that happens, the broker will publish the messages to all clients that subscribed to the Will Topic to notify the disconnection. If the client disconnects from the broker with a client-initiated disconnection using the MQTT DISCONNECT message, the broker won't publish the stored LWT messages. In all other cases, the LWT messages will be dispatched. For a complete list of the disconnect scenarios when the broker will send the LWT messages, see [Connect/Disconnect events](https://docs.aws.amazon.com/iot/latest/developerguide/life-cycle-events.html#connect-disconnect). +The broker will store the Will Messages until an uninitiated disconnection occurs. When that happens, the broker will publish the messages to all clients that subscribed to the Will Topic to notify the disconnection. If the client disconnects from the broker with a client-initiated disconnection using the MQTT DISCONNECT message, the broker won't publish the stored LWT messages. In all other cases, the LWT messages will be dispatched. Due to the asynchronous nature of disconnect processing, LWT messages are not guaranteed to be dispatched in order during reconnection. We recommend that you use [lifecycle events](./life-cycle-events.html) to improve the accuracy of connectivity state detection, as these events provide attributes such as timestamps and version numbers to manage out-of-order events. For a complete list of the disconnect scenarios when the broker will send the LWT messages, see [Connect/Disconnect events](https://docs.aws.amazon.com/iot/latest/developerguide/life-cycle-events.html#connect-disconnect).