title: Lock create/update/delete requests per user
body: <p>I have a payment system written in Asp.Net Core &amp; Entity Framework &amp; SQL Server.
  I have to deal with many security situations where I need to prevent 2 or more actions performed by the user at the same time. For example:</p>
  <p>Every time a payment transaction happens</p>
  <ol>
  <li>Check user balance and block if there is not enough credit.</li>
  <li>Perform the payment and reduce the user balance.</li>
  </ol>
  <p>Now if a user fires 2 or more request to create payments, some of the requests will past the available credit validation.
  Since I have many scenarios similar to this one I thought about a general solution that can solve all of them. I thought about adding a middleware which will check each request and to the following:</p>
  <ol>
  <li>If the request is a GET request it will pass - this will enable concurrency GET requests.</li>
  <li>If the request is a POST/PUT/DELETE request it will check if there is already an existing POST/PUT/DELETE for this specific user (assuming the user is logged in). If there is, a response of bad request will return to the client.</li>
  </ol>
  <p>In order to do this in the correct way and support more than 1 server, I understand that I need to do this in the database level. I know that I can lock a specific row in Oracle and thinking about locking the user row on the beginning of each UPDATE/CREAT/DELETE and release it in the end. What is the best approach to do this with EF? Is there a better solution?</p>
  <p>I'm using the UnitOfWork pattern which each request has its own scope.</p>