Flask-security: v3 making tests run slowly

[mafrosis]

Hey @jirikuncar, thanks for all your recent work on Flask-Security.

I've been having a pretty weird time with the recent v3 release. Our tests now run about 10 times more slowly than before - and debugging suggests it's down to our calls to /login endpoint. I saw this in the changelog:

Upgraded passlib, and removed bcrypt version restriction.

Also profiling suggests 98.9% of a test's time is spent in <built-in method _crypt.crypt>.

This all leads me to believe a change to underlying hash algo is causing 1 second-ish pauses on calls to utils.verify_hash?

Can you confirm any of this please? :D

[mafrosis]

Setting config['SECURITY_PASSWORD_HASH'] = 'plaintext' reduces our test run time back down to close to the original number.

[jonafato]

This is likely due to making bcrypt the default hashing scheme, not upgrading passlib. This is by design; bcrypt is meant to be slow to prevent brute force password cracking. If you'd like to speed up your test suite, changing your PASSWORD_HASH setting (for your test environment only, don't do this in production) to something faster (e.g. 'plaintext') will help.

[mafrosis]

@jonafato our app is configured to use pbkdf2_sha512

[jonafato]

pbkdf2 is also a password hashing algorithm intended to be slow. Does changing this value to plaintext drastically reduce the time spent in that function? If not, something's likely going wrong under the hood and causing a lot of hashing when it shouldn't be. In either case, I'd be surprised if lifting a bcrypt version restriction was related to this, especially if you're not using bcrypt 😄.

[mafrosis]

@jonafato Agreed on all counts. Thanks. I ought to learn my hash algorithms ;)

Switching to plaintext does indeed reduce test run time by 50%. It's still a lot slower than pre-v3 though. One thing I don't understand is that the profiler still shows 96% of the time is spent inside _crypt.crypt (similar to before), even with plaintext.

http://svgur.com/i/22L.svg

[mafrosis]

I got to the bottom of it eventually :) Thanks @jonafato

The following config variables were necessary:

# override the flask-security config for fast password hashes
flask_app.config['SECURITY_HASHING_SCHEMES'] = ['plaintext']
flask_app.config['SECURITY_DEPRECATED_HASHING_SCHEMES'] = []

And the following also gives a minor and useful speed bump too:

flask_app.config['SECURITY_PASSWORD_HASH'] = 'plaintext'