7.4.0-preview1

[sruke]

7.4.0-preview1

Performance Improvements:

• The existing JsonWebToken constructors now utilizes ReadOnlyMemory and Span to extract token segments, eliminating the need for string.split operations.
• A new constructor has been introduced that accepts ReadOnlyMemory of an encoded token. See issue #2487.

Performance Assessment on .NET 8:

• When using the preview version and opting for the constructor that accepts a string for the encoded token, the generation of a JWS yields a 3.95% decrease in memory usage, a 4.52% reduction in Gen0, and a 4.61% decrease in execution time compared to the latest release.
• The performance of the constructor that accepts ReadOnlyMemory is comparable to the constructor accepting a string for the encoded token, both for JWS and JWE.

Preview branch:

Dev (main) branch:

View the benchmarks here.

Why give it a try?

• The new constructor allows you to leverage spans for slicing the encoded token directly from the Authorization Header eliminating additional String.Split operations on your end and can further improve performance.
• Upgrading to the preview version will result in a performance improvement to the code that uses the JsonWebToken(string encodedToken) constructor, without making any additional modifications.

Your feedback is much appreciated. Please try out the preview version and share your comments and suggestions promptly as it would us further refine the design.

---

This discussion was created from the release 7.4.0-preview1.

[sruke]

@leastprivilege @kevinchalet @brockallen: please try out the preview version and share your comments.

[sruke]

We plan to move this version out of preview on 26th February (Monday). Would appreciate any feedback you could provide by then.

[sruke]

@keegan-caruso found that ReadJWETokenTests is not an appropriate benchmark for assessing JWE creation performance. Claims are not populated during JsonWebToken creation since the token is encrypted; they are only populated during validation when the token is decrypted. ValidateJWEAsyncTests is a more suitable benchmarks that creates and validates a JWE. On running this benchmark, there is no performance concern. There is a .5% reduction in memory allocation.

sruthi/JsonWebTokenSpan

BenchmarkDotNet=v0.13.5, OS=Windows 11 (10.0.22631.3007), VM=Hyper-V
AMD EPYC 7763, 1 CPU, 16 logical and 8 physical cores
.NET SDK=8.0.200-preview.23624.5
  [Host]    : .NET 8.0.1 (8.0.123.58001), X64 RyuJIT AVX2
  MediumRun : .NET 8.0.1 (8.0.123.58001), X64 RyuJIT AVX2

Job=MediumRun  MaxAbsoluteError=10.0000 ms  IterationCount=15  
LaunchCount=4  WarmupCount=10  

Method	Mean	Error	StdDev	P90	P95	P100	Gen0	Gen1	Allocated
JsonWebTokenHandler_ValidateJWEAsync	40.20 μs	0.113 μs	0.252 μs	40.56 μs	40.63 μs	40.90 μs	0.9766	0.1221	16.2 KB

dev

BenchmarkDotNet=v0.13.5, OS=Windows 11 (10.0.22631.3007), VM=Hyper-V
AMD EPYC 7763, 1 CPU, 16 logical and 8 physical cores
.NET SDK=8.0.200-preview.23624.5
  [Host]    : .NET 8.0.1 (8.0.123.58001), X64 RyuJIT AVX2
  MediumRun : .NET 8.0.1 (8.0.123.58001), X64 RyuJIT AVX2

Job=MediumRun  MaxAbsoluteError=10.0000 ms  IterationCount=15  
LaunchCount=4  WarmupCount=10  

Method	Mean	Error	StdDev	P90	P95	P100	Gen0	Gen1	Allocated
JsonWebTokenHandler_ValidateJWEAsync	40.33 μs	0.133 μs	0.286 μs	40.61 μs	40.72 μs	41.39 μs	0.9766	0.1221	16.29 KB

[kevinchalet]

We plan to move this version out of preview on 26th February (Monday). Would appreciate any feedback you could provide by then.

I just gave 7.4.0-preview1 a try and I didn't notice any regression in my ASP.NET 4.8 and ASP.NET Core 2.1/8.0 sandbox apps: great job!

AMD EPYC 7763

Woo, that's a nice little CPU you got, @sruke 😄

[brockallen]

I just gave 7.4.0-preview1 a try and I didn't notice any regression

Same, thanks.