lasdf1234 opened a new pull request, #13264:
URL: https://github.com/apache/gravitino/pull/13264
### What changes were proposed in this pull request?
Addresses #13263:
1. **Cache successfully verified Basic credentials**
After a full SHA3-512 verification succeeds, remember the credential
briefly so repeat requests from the same client skip password re-derivation.
2. **Keep failed logins expensive**
Wrong passwords / unknown users are never cached and still pay the full
derivation cost when a stored hash is checked.
3. **Fail closed on credential change**
Authentication always reloads the user from storage and compares the
cached password-hash fingerprint. Local writes (`changePassword`,
`updateEnabled`, `removeUser`, `addUser`) also invalidate the username's cache
entry.
4. **Configuration + docs**
- `gravitino.idp.basic.verifiedCredentialCacheExpirationSecs` (default
`60`, `0` disables)
- `gravitino.idp.basic.verifiedCredentialCacheMaxSize` (default `10000`)
### Why are the changes needed?
Basic clients resend credentials on every request. With
`$sha3-512$i=100000$`, each request costs ~40 ms of CPU. Under modest load this
saturates the server and slows other users. Industry password-hash cost belongs
on login, not on every API call.
Fix: #13263
### Does this PR introduce _any_ user-facing change?
- Successful Basic auth repeat requests no longer re-derive the password
hash within the cache TTL.
- New optional config keys for cache TTL and size (defaults enabled at 60s /
10000 entries).
- Docs describe the cache behavior and revocation semantics.
### How was this patch tested?
```bash
./gradlew :plugins:idp-basic:test \
--tests org.apache.gravitino.idp.basic.TestVerifiedBasicCredentialCache \
--tests org.apache.gravitino.idp.TestIdpUserGroupManagerCredentialCache \
--tests org.apache.gravitino.idp.TestIdpUserGroupManager \
-PskipITs -PskipDockerTests=true
```
Made with [Cursor](https://cursor.com)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
