Reduce the client TLS session cache size #1067
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Generate changelog in
|
We've seen heap dumps with ~500mb of tls session cache despite an expectation that connections are reused. These large session caches seem to show that we are creating new sessions anyhow, so there's little point in caching old data.
carterkozak
force-pushed
the
ckozak/reduce_client_tls_session_cache_size
branch
from
120b90a to
339ccee
Compare
iamdanfox
reviewed
Nov 30, 2020
| .orElseGet(() -> SslSocketFactories.createSslContext(serviceConfig.security())); | ||
| // Reduce the session cache size for clients. We expect TLS connections to be reused, thus the cache isn't | ||
| // terribly important. | ||
| context.getClientSessionContext().setSessionCacheSize(100); |
There was a problem hiding this comment.
down from a default of 20480 by the looks of things
/**
* Returns the size of the cache used for storing <code>SSLSession</code>
* objects grouped under this <code>SSLSessionContext</code>.
*
* @implNote The JDK implementation returns the cache size as set by
* the {@code setSessionCacheSize} method, or if not set, the
* value of the {@systemProperty javax.net.ssl.sessionCacheSize}
* system property. If neither is set, it returns a default
* value of 20480.
*
* @return size of the session cache; zero means there is no size limit.
*
* @see #setSessionCacheSize
*/
public int getSessionCacheSize();
iamdanfox
approved these changes
Nov 30, 2020
bulldozer-bot
bot
deleted the
ckozak/reduce_client_tls_session_cache_size
branch
|
Released 1.89.0 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Before this PR
We've seen heap dumps with ~500mb of tls session cache despite an
expectation that connections are reused. These large session caches seem
to show that we are creating new sessions anyhow, so there's little
point in caching old data.
After this PR
==COMMIT_MSG==
Reduce the client TLS session cache size
==COMMIT_MSG==
Possible downsides?
if the cache is needed in some scenario, we may see a lower hit rate.