Conversation
Every API-key-authenticated request ran bcrypt.compareSync, blocking the event loop 60-100ms and capping each process at roughly 10-20 req/s. That was the first hard ceiling for device traffic (heartbeats, status callbacks, inbound SMS). API keys are high-entropy random tokens, so slow hashing buys nothing: bcrypt exists to protect low-entropy passwords from offline brute force. verifyApiKey now resolves a key with a single indexed sha256 lookup. Keys issued before this change have no sha256 stored, so they fall back to the old masked lookup plus one async bcrypt.compare, then backfill their own sha256 and use the fast path from then on. Nothing is invalidated and no user action is required. bcrypt hashes are still written for new keys so a revert keeps authenticating every key. New keys are txb_ plus 32 base62 characters, replacing uuidv4. The prefix makes a leaked key identifiable and allows registering a secret scanning pattern later. The masked display shape is unchanged, which is what keeps a revert working for keys issued mid-migration. Both AuthGuard and OptionalAuthGuard are migrated; the latter had the same compareSync call and no test file, so it gets one. Rejecting non-string input also fixes a pre-existing 500: an object or array from the apiKey query param previously reached .substring(). Passwords continue to use bcrypt. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
perf(auth): resolve API keys via indexed sha256 instead of bcrypt
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.