Improve performance of Basic Authentication

michaelwechner commented 11 years ago

If one is requesting a html page which is protected by Basic Authentication, then the performance can be very bad, because a html page can contain many links to css, javascript, images, etc. for which also the basic authentication needs to be executed.

This means for requesting a simple html page, the server has to do maybe 10-30 basic authentications, whereas since Yanel is using bcrypt (http://en.wikipedia.org/wiki/Bcrypt), each basic authentication might take 1 second, which means that serving a simple page can take about 30seconds!

In the case of session authentication this is not a problem, because one does only one authentication, then the session is used.

The question is whether we can somehow cache the Basic authentication, instead using bcrypt for every request?

michaelwechner commented 10 years ago

This problem is also rather annoying, when one is configuring Tomcat with BASIC AUTH

TOMCAT/conf/tomcat-users.xml (tomcat-users)
TOMCAT/webapps/yanel/WEB-INF/web.xml (security-constraint, login-config) as a first level protection. A possible workaround might be to make Basic Auth check configurable for Yanel

michaelwechner commented 10 years ago

An alternative might be to check first whether a URL is available for world, and if so, then the BASIC AUTH check will not be necessary.

michaelwechner commented 10 years ago

According to log file, the YanelServlet is calling

YanelServlet.getIdentity()

not just from within

YanelServlet.doAccessControl()

but rather it is called at many other places, which makes it even slower.

wyona / yanel

Improve performance of Basic Authentication #41