ory / hydra

The most scalable and customizable OpenID Certified™ OpenID Connect and OAuth Provider on the market. Become an OpenID Connect and OAuth2 Provider over night. Broad support for related RFCs. Written in Go, cloud native, headless, API-first. Available as a service on Ory Network and for self-hosters.
https://www.ory.sh/?utm_source=github&utm_medium=banner&utm_campaign=hydra
Apache License 2.0
15.66k stars 1.5k forks source link

fix: cpu contention on jwk reads + suppress duplicate jwk generation #3870

Closed terev closed 3 weeks ago

terev commented 3 weeks ago

Using the reproduction steps included in #3863 I'm able to confirm this fixes the read contention:

bombardier -d 30s -t 30s -a -c 270 -l http://localhost:4444/.well-known/openid-configuration
Bombarding http://localhost:4444/.well-known/openid-configuration for 30s using 270 connection(s)
[==============================================================================================================================================================] 30s
Done!
Statistics        Avg      Stdev        Max
  Reqs/sec      3768.36    2589.36   12964.59
  Latency       71.76ms    29.92ms   579.56ms
  Latency Distribution
     50%    67.30ms
     75%    82.45ms
     90%    98.98ms
     95%   113.15ms
     99%   184.51ms
  HTTP codes:
    1xx - 0, 2xx - 112946, 3xx - 0, 4xx - 0, 5xx - 0
    others - 0
  Throughput:     7.70MB/s

I also noticed the .well-known/jwks.json route generates extra keys (if hammered before initialized) so I changed that handler to utilize the same duplicate suppression code.

Related issue(s)

Closes #3863

Checklist

Further Comments

aeneasr commented 3 weeks ago

Great job everyone, thanks!

terev commented 3 weeks ago

🎉 Thanks for the well written initial report @awill1988 !

awill1988 commented 3 weeks ago

Awesome fix @terev!