Token verification cache #1384

New issue

Closed

opened 2025-12-28 17:22:48 +00:00 by sami · 0 comments

sami commented

2025-12-28 17:22:48 +00:00

Owner

Originally created by @roman-khimov on GitHub (Mar 21, 2025).

Originally assigned to: @cthulhu-rider on GitHub.

I'm always frustrated when we're wasting resources for operations we can avoid. Most of the time NeoFS PUT/GET requests come with some kind of token (session/bearer). Nodes validate these tokens as they should be doing, but they do it for every request, while in fact tokens do not change often. Currently this means an additional signature verification, but with https://github.com/nspcc-dev/neofs-node/issues/3194 implemented it could mean an additional RPC request.

Describe the solution you'd like

Hash and cache. When we get a token that was verified previously just trust the previous verification result. This obviously is about token validity, not request validity wrt provided token, because a good PUT session token still doesn't allow to perform GET, but at least we can immediately say that the token is OK.

Describe alternatives you've considered

Keep wasting resources per request.

Originally created by @roman-khimov on GitHub (Mar 21, 2025). Originally assigned to: @cthulhu-rider on GitHub. ## Is your feature request related to a problem? Please describe. I'm always frustrated when we're wasting resources for operations we can avoid. Most of the time NeoFS PUT/GET requests come with some kind of token (session/bearer). Nodes validate these tokens as they should be doing, but they do it for every request, while in fact tokens do not change often. Currently this means an additional signature verification, but with https://github.com/nspcc-dev/neofs-node/issues/3194 implemented it could mean an additional RPC request. ## Describe the solution you'd like Hash and cache. When we get a token that was verified previously just trust the previous verification result. This obviously is about token validity, not request validity wrt provided token, because a good PUT session token still doesn't allow to perform GET, but at least we can immediately say that the token is OK. ## Describe alternatives you've considered Keep wasting resources per request.