Shrine taking long time in a web request

[andychongyz]

Hi people, I implemented direct upload to s3 with Shrine. However, Shrine events seems to be taking a long time, for example: open.shrine, metadata.shrine, and mime_type.shrine, as tracked by Appsignal. Every event took around 1 second, how can I speed this up? Screenshot as below:

[andychongyz]

Is there anything to do with https://shrinerb.com/docs/metadata#extracting-on-attachment? Wasn't this just read from the metadata params pass from the client? Why "open.shrine" event is triggered?

[janko]

It does take the metadata passed from the client if restore_cached_data plugin is not loaded. But loading it is recommended, because otherwise metadata from direct upload can be tampered with, so anyone can choose to send different metadata that bypasses validations. For example, it could allow the attacker to upload an image type that ImageMagick or libvips happen to be vulnerable to, even if your validations don't allow it.

[andychongyz]

Understood. If I want to speed up the web request without sacrificing the security aspect, according to https://shrinerb.com/docs/metadata#extracting-in-the-background, I should be using refresh_metadata instead of restore_cached_data, right?

Given that metadata is processed in the background job, the metadata.shrine & mime_type.shrine events should be eliminated from the web request?

And for optimization, I should follow https://shrinerb.com/docs/metadata#optimizations, and change my promote job as below?

attacher = attacher_class.retrieve(model: record, name: name, file: file_data)
attacher.create_derivatives if attacher.respond_to?(:create_derivatives)
attacher.refresh_metadata!

#to
attacher.file.open do
  attacher.refresh_metadata!
  attacher.create_derivatives if attacher.respond_to?(:create_derivatives)
end