#24696: CSRF middleware wastefully calculates new tokens that are never used .
-------------------------------------+-------------------------------------
Reporter: electricjay | Owner: nobody
Type: | Status: new
Cleanup/optimization |
Component: CSRF | Version: 1.8
Severity: Normal | Resolution:
Keywords: CSRF performance | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by electricjay):
It is not the context processor causing the computation. It is the csrf
middleware (CsrfViewMiddleware .process_view) which computes a new token
automatically if there was no csrf cookie sent with the request.
I benchmarked a simple view using ''siege'' with the csrf middleware
active and again with my patch applied to come up with the 40% number.
The view I benchmarked:
{{{
def json(request):
response = {
"message": "Hello, World!"
}
return HttpResponse(uj_dumps(response), content_type="application/json")
}}}
I also ran it under the python cprofiler before patching while exercising
the above view and got these results:
{{{
Trimmed for relavant section
ncalls tottime percall cumtime percall filename:lineno(function)
1418 0.010 0.000 4.970 0.004
SocketServer.py:282(_handle_request_noblock)
1418 0.007 0.000 4.882 0.003
SocketServer.py:315(process_request)
1418 0.018 0.000 4.775 0.003
SocketServer.py:332(finish_request)
1418 0.011 0.000 4.752 0.003 basehttp.py:97(__init__)
1418 0.013 0.000 4.452 0.003
SocketServer.py:643(__init__)
1418 0.028 0.000 4.374 0.003 basehttp.py:161(handle)
1417 0.011 0.000 3.775 0.003 handlers.py:76(run)
1417 0.047 0.000 2.800 0.002 wsgi.py:150(__call__)
1417 0.076 0.000 2.311 0.002 base.py:93(get_response)
1417 0.023 0.000 1.123 0.001 csrf.py:105(process_view)
18450/18444 0.094 0.000 1.096 0.000 {method 'join' of
'unicode' objects}
1417 0.005 0.000 1.083 0.001
csrf.py:36(_get_new_csrf_key)
1417 0.007 0.000 1.078 0.001
crypto.py:54(get_random_string)
46761 0.128 0.000 1.002 0.000 crypto.py:77(<genexpr>)
}}}
In this example no csrf token is ever sent back to the requesting client
but it is spending a fair amount of time calculating it on every request.
--
Ticket URL: <https://code.djangoproject.com/ticket/24696#comment:2>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/069.9eb66bb4bd468b9330fd9d5f17ce0bc3%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
