In Cosmo / <PROJECT_NAME> we have a customer facing BAP application.
Because BAP is not able to have unauthenticated users work with a12 documents/models, we do a dummy login with guest/guest on every page load/refresh.
This login takes 3 to 4 seconds. This is much too slow for us.
Why does it take so long to check the credentials and more importantly:
Is there any workaround for this performance bug?
You could try to debug “ShiroAuthenticationService” and look what is slow.
Maybe the lucene/solr index need to optimize?
The login duration was targeted as security topic by security partners. Therefore the length of the request is intentionally long because the org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder needs a strength of the password to be provided for it. The default strength is configured here: mgm.services.core.user.password.strength=15. You can lower the password strength if you want to have faster logins but the login will be less secure.
As Tomas described, the delay for the login is intended for security reasons. Let me emphasize that a reduction of the strength property may put all your user accounts at risk.
Instead, I do recommend to keep your anonymous users logged in as guest such that you don’t need a new login with every page load/refresh.
Thanks a lot for the answers!
A password strength (hash rounds?) that causes a 3 seconds delay (on decent hardware) sounds excessive to me.
Other web sites (even of companies with a good security track record) have logins that are much faster.
But we could discuss that with out sp representative.
The real problem is, of course, the need to login even for anonymous access.
I don’t really understand this one, though:
I do recommend to keep your anonymous users logged in as guest
How should “keep logged in” work?
Hi Stephen,
“keep logged in” means that the login you perform creates an temporary authentication credential (session id cookie or JWT) which takes time upon creation but can also serve to stop the repeated login with the next request. So, you can set this (anonymous) credential in the browser and omit another login upon the next request.
I hope that helps. Please discuss this (or other options) with your sp consultant(s).
