PasswordAuthenticationMiddleware takes an excessive amount of time to complete requests about bcrypt HOT 4 CLOSED

i'm guessing this is a problem w/ password hashing being slow.

• which swift version are you using?
• are you using bcrypt?
• if so, what's your cost factor.
• does the time it takes change in if built in release mode?

from bcrypt.

@tanner0101 Swift 4.0, BCrypt, cost factor 4 or 12 from slack and the code example.

This bug has been investigated by me and seems to be a compiler issue in Swift 4's debug compilation. Specifically the encipher function. Running this on Release should fix all issues.

EDIT: My recommended (temporary) solution is running a different cost factor on debug mode (locally). Your live server should be compiled on release, regardless. So the performance should be good there

from bcrypt.

Oops, sorry. Missed that code was supplied. @bsarrazin can you verify if compiling release solves the problem? If so, I'd also recommend using a lower cost factor in development mode. That way you can continue to compile debug without having slow hashing.

This can be easily done by adding a Config/development/bcrypt.json file with the lower cost factor.

Or conversely by adding a Config/production/bcrypt.json with the higher cost factor and having the default Config/bcrypt.json contain a lower one.

Additionally, you might consider using password auth for just login/signup and creating a token to verify subsequent requests. This is a lot more performant than hashing the password each request.

from bcrypt.

This is super old, unlikely to be still applicable, we can reopen if needed.

from bcrypt.