search

istio-ecosystem / authservice

Move OIDC token acquisition out of your app code and into the Istio mesh
Apache License 2.0
217 stars 63 forks source link

Cache well-known responses to avoid making too much calls to the IdP #251

Closed nacx closed 6 months ago

nacx commented 6 months ago

While working on https://github.com/istio-ecosystem/authservice/pull/250, I saw that authservice was calling many times the well-known endpoint for a single OIDC session. This is because we call it when initializing the OIDC handlers, and that is done per request to the Envoy ext-authz filter, and a single OIDC session may involve several requests, given the redirects, making several unnecessary calls to the IdP.

This PR caches the seen well-known requests, and returns them from the cache for subsequent requests. The well-known endpoints are usually stable and it is very rare that they change, so it should be fine to just cache them by default.

istio-testing commented 6 months ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: nacx, sergicastro

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/istio-ecosystem/authservice/blob/main/OWNERS)~~ [nacx] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment