# Is scroll id always same for one user **URL:** \ **Category:** Elasticsearch\ **Created:** [April 7, 2021, 7:33pm UTC](https://discuss.elastic.co/t/is-scroll-id-always-same-for-one-user/269517 "2021-04-07T19:33:30Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![IliaIsakhin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iliaisakhin/32/75238_2.png) [@IliaIsakhin](https://discuss.elastic.co/u/IliaIsakhin)\ **Post date:** [April 7, 2021, 7:33pm UTC](https://discuss.elastic.co/t/is-scroll-id-always-same-for-one-user/269517/1 "2021-04-07T19:33:30Z")
For example, I have an Elasticsearch cluster with a single user and two different applications that want to retrieve all documents from the index to process them. Both applications are using search with scroll mechanism and same user credentials. Is there a chance that documents in the index will be divided between two applications, because generated scroll IDs contains same info about user which perform requests? I've read this [documentation page](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-limitations.html#can-access-resources-check) and as I understand, the behavior I mentioned above is a normal situation? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 7, 2021, 10:14pm UTC](https://discuss.elastic.co/t/is-scroll-id-always-same-for-one-user/269517/2 "2021-04-07T22:14:36Z")
> [@IliaIsakhin](#): > > two different applications > [@IliaIsakhin](#): > > Both applications are using search with scroll mechanism and same user credentials. That's a concern. If they are different then it makes sense to have different credentials. > [@IliaIsakhin](#): > > Is there a chance that documents in the index will be divided between two applications, because generated scroll IDs contains same info about user which perform requests? Based on what the docs say, yes, there is a chance because you're sharing credentials. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [April 8, 2021, 4:29am UTC](https://discuss.elastic.co/t/is-scroll-id-always-same-for-one-user/269517/3 "2021-04-08T04:29:17Z")
> [@IliaIsakhin](#): > > Is there a chance that documents in the index will be divided between two applications, because generated scroll IDs contains same info about user which perform requests? No, that is not possible. The scroll id describes the state of a single request, if two requests are sent they will have separate scroll ids, even if they are for the same user. > [@IliaIsakhin](#): > > I've read this [documentation page](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-limitations.html#can-access-resources-check) and as I understand, the behavior I mentioned above is a normal situation? That is a section titled `Resource sharing check for users and API keys` it means that if your two applications share a userid, nothing within security will _stop_ them from accessing the scrolls of the other application. Elasticsearch will treat the 2 applications as the same user, and allow them to share resources. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 8, 2021, 4:36am UTC](https://discuss.elastic.co/t/is-scroll-id-always-same-for-one-user/269517/4 "2021-04-08T04:36:05Z")
Does that apply if it's the same request? ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [April 8, 2021, 5:19am UTC](https://discuss.elastic.co/t/is-scroll-id-always-same-for-one-user/269517/5 "2021-04-08T05:19:36Z")
By "same request" I assume you mean "exact same query", in which case yes, it still applies. Scroll works correctly when security is not enabled - two identical queries will each get a different scroll id. Security doesn't break that. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 8, 2021, 5:33am UTC](https://discuss.elastic.co/t/is-scroll-id-always-same-for-one-user/269517/6 "2021-04-08T05:33:52Z")
Ok, I misunderstood the docs then. > The result of [async search](https://www.elastic.co/guide/en/elasticsearch/reference/current/async-search.html) and [scroll](https://www.elastic.co/guide/en/elasticsearch/reference/current/scroll-api.html) requests can be retrieved later by the same user or API key that submitted the initial request. I guess that should be expanded to say something about it needing to be using the exact same scroll ID that was returned. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 6, 2021, 5:34am UTC](https://discuss.elastic.co/t/is-scroll-id-always-same-for-one-user/269517/7 "2021-05-06T05:34:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.