[I] GPSPRINGSECURITYCORE-203: Bad performance in security checks [grails-core]

["graemerocher (via GitHub)" <gi...@apache.org>]

graemerocher opened a new issue, #15862:
URL: https://github.com/apache/grails-core/issues/15862

   Original Reporter: rogovskiy
   Environment: Not Specified
   Version: Grails-Spring-Security-Core 2.0
   Migrated From: http://jira.grails.org/browse/GPSPRINGSECURITYCORE-203
   
   Our application has 400 roles. If you look at the performance numbers in profiler you can see that GrantedAuthorityImpl.getAuthority() is called thousands of times.
   
   The plugin uses hierarchical role model by default and runs a double loop to generate effective list of roles comparing role names in that loop. With 400 roles we are probably looking at 400 x 400 / 2 = 80,000 String.equals calls. Not the end of the world but something.
   
   Now if you look at it at the bigger picture this calculation never gets cached. Every security check in the application reruns it:
   
   ```
   public static boolean ifAllGranted(final String roles) {
      Collection<GrantedAuthority> inferred = findInferredAuthorities(getPrincipalAuthorities());
      return inferred.containsAll(parseAuthoritiesString(roles));
   }
   ```
   
   Our application has up to 100 security checks in a controller action. If you multiply 80,000 String equals by factor of 100 it becomes significant: 8,000,000 calls.
   
   Suggestion would be to cache the results of findInferredAuthorities. There is a work around for us. Since we are not using hierarchical roles we can disable this whole behavior using NullRoleHierarcy. 
   
   Attached JProfile call trace.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org