SEC-2521: Improve StandardPasswordEncoder Performance

[spring-projects-issues]

pascal gehl (Migrated from SEC-2521) said:

My web application uses a StandardPasswordEncoder to match passwords in Basic Authentication.
Under heavy load (700 Http requests per second) org.springframework.security.crypto.password.Digester becomes a major source of contention in

public byte[] digest(byte[] value) {
synchronized (messageDigest) {
... ommitted for clarity
}
}

At 700 HTTP requests per seconds this synchronized block has an average contention of 247 milliseconds with maximums of 1.18 seconds.

At 500 HTTP requests per seconds this synchronized block has an average contention of 28 milliseconds with maximums of 291 milliseconds.

I wonder if there is a non synchronized alternative to StandardPasswordEncoder ?

[spring-projects-issues]

Rob Winch said:

Thanks for the report. We can improve the performance by creating a new Digest instead of using synchronized.

[spring-projects-issues]

pascal gehl said:

We ended up creating a PooledPasswordEncoder using commons-pool2 with the size of the pool roughly equals to the number of threads in the web container.