From 598e3b384257c68886ea2d90a9c520ab5ca2f019 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 16 Oct 2026 22:10:00 -1000 Subject: Read the auth cookie in linear time Splitting the header with patterns that backtrack over spaces cost a quarter of a second per request at the 8 KB line most web servers allow, and a second at 16 KB, without any login. auth-file's trim had the same shape and now reads the cookie as well. --- tests/extensions/test-auth.lua | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'tests') diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 0025a81..5d3541c 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -121,6 +121,16 @@ h.equals("a lone cookie is found", get_cookie("cgitauth=abc", "cgitauth"), "abc" h.equals("no header yields no cookie", get_cookie(nil, "cgitauth"), nil) h.equals("a longer name does not match", get_cookie("xcgitauth=z", "cgitauth"), nil) h.equals("a magic character in the name is taken literally", get_cookie("a-b=z", "a-b"), "z") +h.equals("spaces around a pair are ignored", get_cookie(" foo=1 ; cgitauth=abc ", "cgitauth"), "abc") +h.equals("a value keeps its own equals signs", get_cookie("cgitauth=a=b", "cgitauth"), "a=b") + +-- The Cookie header is the visitor's to write, so a run of spaces in it +-- must not cost the square of its length. +local started = os.clock() +get_cookie("a=" .. string.rep(" ", 20000) .. "b", "cgitauth") +h.equals("a long run of spaces is read quickly", + get_cookie(string.rep(" ", 20000) .. "cgitauth=abc", "cgitauth"), "abc") +h.check("and in linear time", os.clock() - started < 0.5) h.check("equal strings compare equal", constant_equals("abc", "abc")) h.check("differing strings do not", not constant_equals("abc", "abd")) -- cgit