lasdf1234 opened a new issue, #13263: URL: https://github.com/apache/gravitino/issues/13263
### Version main branch ### Describe what's wrong Built-in IdP Basic authentication (`idp-basic`) verifies passwords with `$sha3-512$i=100000$` on **every** HTTP request that carries credentials. There is no cache of already-verified credentials, so legitimate high-QPS Basic clients pay ~40 ms of CPU per request and can saturate the server. ### Error message and/or stacktrace Not an exception. Measured on an idle server (basic authenticator + built-in IdP): | Request | Average | |---|---| | No credentials (401) | ~1 ms | | Wrong / correct password (401/200) | ~40 ms | Under about 100 RPS from one Basic client, server CPU rose to hundreds of percent on an 8-core machine and the UI slowed for other users. ### How to reproduce 1. Configure `gravitino.authenticators = basic` with the built-in IdP. 2. Repeatedly call an authenticated endpoint (for example `GET /api/version`) with the same valid Basic credentials. 3. Observe ~40 ms auth cost and high CPU on each request. ### Additional context Related enterprise report: datastrato/gravitino-enterprise#2058. Preferred fix: cache **successful** verifications briefly; never cache failures; invalidate on password change / disable / remove; always reload the user from storage so revocation is fail-closed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
