Use local copy of Google OAuth2 certificates.

[itotallyrock]

Situation

Currently we have a few options. On every request we ask Google for their certificates. On startup we save their certificates to a variable in memory. Or we keep a local cache for each process that expires.

Pros and cons to each...

Send a request to Google Each Time

Pros

• Never will have a certificate expire
• Certificates are always going to work as long as a token hasn't expired
• Little work for this to be implemented

Cons

• Slow, if we do this for each request it takes roughly 200ms per request extra (certificates aren't small)
• If for some reason Google goes down but we still have tokens we can't do anything

Startup Certificates

Pros

• Currently implemented (no changed necessary)
• Relatively fast, only one request is needed and it only slows startup rather than each request

Cons

• Certificates expire and unless the server automatically restarts at set intervals tokens will no longer be able to be validated
• Storing them in memory is bad practice but it needs to be stateless to be in application
• Delays the startup of the application
  • Slows down unit testing
  • Slows down automated services
  • Bad for running in development environments
  • Just bad in general to slow down startup

Local Cache

Pros

• Will handle any certificate expiration
• Will act somewhat stateless
• Should automatically renew certificates

Cons

• Most work required to setup
• Could potentially slow down requests
• I have zero experience with

[itotallyrock]

For the most part this has been fully implemented and will be seen in an upcoming commit. I decided to use the local cache strategy as it was most fitting and solved the most problems with the simplest solutions.