perf: Antiforgery token validation & generation #61989

DeagleGross · 2025-05-19T10:47:46Z

IN PROGRESS

main stats for benchmark

OS	Method	Mean	Error	StdDev	Gen0	Gen1	Gen2	Allocated
win	Generate	7,175.2 ns	4.19 ns	3.50 ns	0.1297	-	-	4096 B
win	ValidateWithUser	768.0 ns	2.52 ns	2.35 ns	0.0334	0.0010	0.0010	-
win	Validate	144.4 ns	0.21 ns	0.18 ns	0.0045	0.0005	0.0005	120 B

{PR title}

You've read the Contributor Guide and Code of Conduct.
You've included unit or integration tests for your change, where applicable.
You've included inline docs for your change, where applicable.
There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Summary of the changes (Less than 80 chars)

Description

{Detail}

Fixes #{bug number} (in this specific format)

gfoidl · 2025-05-19T15:55:02Z

src/Antiforgery/src/Internal/BinaryBlob.cs

        {
            return false;
        }

        var areEqual = true;
-        for (var i = 0; i < a.Length; i++)
+        for (int i = 0; i < a.Length; i++)


Here in ASP.NET Core the convention is to use var, so please undo that change.

Suggested change

for (int i = 0; i < a.Length; i++)

for (var i = 0; i < a.Length; i++)

Same on other places (I'll just leave a short comment over there, so you can find these easier).

this is only a draft PR @gfoidl, I wont yet address PR comments. I need to confirm I am getting perf improvement here. I will come back to the comments later

gfoidl · 2025-05-19T15:56:27Z

src/Antiforgery/src/Internal/DefaultAntiforgeryTokenSerializer.cs

+            var tokenLength = serializedToken.Length;
+            var charsRequired = WebEncoders.GetArraySizeRequiredToDecode(tokenLength);
+
+            var chars = charsRequired < 128 ? stackalloc byte[128] : (rented = ArrayPool<byte>.Shared.Rent(charsRequired));


Move the 128 to a named constant like StackAllocTheshold or similar.

gfoidl · 2025-05-19T15:59:43Z

src/Antiforgery/src/Internal/DefaultAntiforgeryTokenSerializer.cs

+            var chars = charsRequired < 128 ? stackalloc byte[128] : (rented = ArrayPool<byte>.Shared.Rent(charsRequired));
+            chars = chars[..charsRequired];
+
+            var decodedResult = WebEncoders.TryBase64UrlDecode(


~~Starting with .NET 9 the built-in Base64Url methods could be used. They're faster than WebEncoders-version due to vectorization.~~

Nice that use WebEncoders here as shim for the built-in methods 👍🏻
(When reading the PR first, I thought that's missed)

gfoidl · 2025-05-19T16:00:14Z

src/Antiforgery/src/Internal/DefaultClaimUidExtractor.cs

@@ -119,6 +139,41 @@ public DefaultClaimUidExtractor(ObjectPool<AntiforgerySerializationContext> pool
        return identifierParameters;
    }

+    private static void ComputeSha256(IEnumerable<string> parameters, Span<byte> output, out int bytesWritten)
+    {
+        int estimatedSize = 0;


Suggested change

int estimatedSize = 0;

var estimatedSize = 0;

gfoidl · 2025-05-19T16:01:12Z

src/Antiforgery/src/Internal/DefaultClaimUidExtractor.cs

+        int estimatedSize = 0;
+        foreach (var param in parameters)
+        {
+            int byteCount = Encoding.UTF8.GetByteCount(param);


Suggested change

int byteCount = Encoding.UTF8.GetByteCount(param);

var byteCount = Encoding.UTF8.GetByteCount(param);

gfoidl · 2025-05-19T16:01:44Z

src/Antiforgery/src/Internal/DefaultClaimUidExtractor.cs

+            int offset = 0;
+            foreach (var param in parameters)
+            {
+                int byteCount = Encoding.UTF8.GetByteCount(param);


Suggested change

int byteCount = Encoding.UTF8.GetByteCount(param);

var byteCount = Encoding.UTF8.GetByteCount(param);

gfoidl · 2025-05-19T16:03:52Z

src/Shared/Encoding/Int7BitEncodingUtils.cs

+        int result = 0;
+        int shift = 0;


Suggested change

int result = 0;

int shift = 0;

var result = 0;

var shift = 0;

gfoidl · 2025-05-19T16:04:06Z

src/Shared/Encoding/Int7BitEncodingUtils.cs

+                throw new InvalidOperationException("Invalid 7-bit encoded int.");
+            }
+
+            byte b = span[bytesRead++];


Suggested change

byte b = span[bytesRead++];

var b = span[bytesRead++];

gfoidl · 2025-05-19T16:05:30Z

src/Shared/ReadOnlySpanExtensions.cs

+
+internal static class ReadOnlySpanExtensions
+{
+    public static bool BinaryReadBoolean(this ReadOnlySpan<byte> span, ref int offset)


Suggested change

public static bool BinaryReadBoolean(this ReadOnlySpan<byte> span, ref int offset)

public static bool BinaryReadBooleanAndAdvance(this ReadOnlySpan<byte> span, ref int offset)

? Otherwise the side effect of offset++ maybe astonishing.
Or add an xml-doc comment.

gfoidl · 2025-05-19T16:05:47Z

src/Shared/ReadOnlySpanExtensions.cs

+        int length = span.Read7BitEncodedInt(out int prefixLength);
+        int stringEnd = prefixLength + length;


Suggested change

int length = span.Read7BitEncodedInt(out int prefixLength);

int stringEnd = prefixLength + length;

var length = span.Read7BitEncodedInt(out int prefixLength);

var stringEnd = prefixLength + length;

-10% so far

cdf9957

github-actions bot added the area-networking Includes servers, yarp, json patch, bedrock, websockets, http client factory, and http abstractions label May 19, 2025

DeagleGross added 3 commits May 19, 2025 12:48

try more changes

909ddaa

fix tests

f519131

more

e39c037

gfoidl reviewed May 19, 2025

View reviewed changes

increase limit

fce6205

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

perf: Antiforgery token validation & generation #61989

perf: Antiforgery token validation & generation #61989

DeagleGross commented May 19, 2025 •

edited

Loading

gfoidl May 19, 2025

DeagleGross May 19, 2025

gfoidl May 19, 2025

gfoidl May 19, 2025

gfoidl May 19, 2025

gfoidl May 19, 2025

gfoidl May 19, 2025

gfoidl May 19, 2025

gfoidl May 19, 2025

gfoidl May 19, 2025

gfoidl May 19, 2025

	for (int i = 0; i < a.Length; i++)
	for (var i = 0; i < a.Length; i++)

	int byteCount = Encoding.UTF8.GetByteCount(param);
	var byteCount = Encoding.UTF8.GetByteCount(param);

	public static bool BinaryReadBoolean(this ReadOnlySpan<byte> span, ref int offset)
	public static bool BinaryReadBooleanAndAdvance(this ReadOnlySpan<byte> span, ref int offset)

		int length = span.Read7BitEncodedInt(out int prefixLength);
		int stringEnd = prefixLength + length;

perf: Antiforgery token validation & generation #61989

Are you sure you want to change the base?

perf: Antiforgery token validation & generation #61989

Conversation

DeagleGross commented May 19, 2025 • edited Loading

{PR title}

Description

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

DeagleGross commented May 19, 2025 •

edited

Loading