Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: handle gcf, verify already provided request.body #936

Closed
wants to merge 13 commits into from

Conversation

Uzlopak
Copy link
Contributor

@Uzlopak Uzlopak commented Nov 29, 2023

Resolves #935

As explained in #935 in gcf the payload is already deserialized to be an object, resulting that the payload can not be verified.

Can this be please fast-tracked?

@wolfy1339
@gr2m


Before the change?

After the change?

Pull request checklist

  • Tests for the changes have been added (for bug fixes / features)
  • Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

  • Yes
  • No

@wolfy1339 wolfy1339 added the Type: Bug Something isn't working as documented, or is being fixed label Nov 29, 2023
@wolfy1339
Copy link
Member

Can you make sure that this doesn't effect values that end in a zero decimal, ex: 123.10

@Uzlopak
Copy link
Contributor Author

Uzlopak commented Nov 29, 2023

@wolfy1339

I think I can do it even better.

@Uzlopak
Copy link
Contributor Author

Uzlopak commented Nov 29, 2023

@wolfy1339
I could not follow, what you mean with handling numbers correctly.

But now it is trying to avoid unecessary serializiation and deserialization based on the input. GCF has body and rawBody, while rawBody is the Buffer.

Let me test this on GCF and give you feedback :).

@Uzlopak
Copy link
Contributor Author

Uzlopak commented Nov 29, 2023

@wolfy1339

It works now properly. Can you please explain what your concern is regarding numbers?

@wolfy1339
Copy link
Member

NodeJS likes to remove trailing zeroes on numbers, and thus it changes the signature of the payload

@Uzlopak
Copy link
Contributor Author

Uzlopak commented Nov 29, 2023

@wolfy1339

In this case, I just handle the specific case of GCF because there is no way I can ensure, that JSON.stringify and .parse will respect that.

PTAL

@Uzlopak
Copy link
Contributor Author

Uzlopak commented Nov 29, 2023

Tested on GCF and works as expected ;)

src/verify-and-receive.ts Outdated Show resolved Hide resolved
src/verify-and-receive.ts Outdated Show resolved Hide resolved
@Uzlopak
Copy link
Contributor Author

Uzlopak commented Nov 30, 2023

@wolfy1339

It is hard to provide a benchmark for body attribute, as it is gcf specific. Passing the body object is only relevant for gcf. In other cases it is just undefined and does not effect significantly the performance. In gcf it actually avoids one JSON.parse.

I really need this PR to land, so i beg you to approve and merge it.

My benchmarks show a significant performance gain from 73k ops/ 10s to 83k ops/ 10s.

before:

┌─────────┬──────┬──────┬───────┬──────┬────────┬─────────┬───────┐
│ Stat    │ 2.5% │ 50%  │ 97.5% │ 99%  │ Avg    │ Stdev   │ Max   │
├─────────┼──────┼──────┼───────┼──────┼────────┼─────────┼───────┤
│ Latency │ 0 ms │ 1 ms │ 4 ms  │ 5 ms │ 0.8 ms │ 1.08 ms │ 31 ms │
└─────────┴──────┴──────┴───────┴──────┴────────┴─────────┴───────┘
┌───────────┬────────┬────────┬────────┬────────┬────────┬─────────┬────────┐
│ Stat      │ 1%     │ 2.5%   │ 50%    │ 97.5%  │ Avg    │ Stdev   │ Min    │
├───────────┼────────┼────────┼────────┼────────┼────────┼─────────┼────────┤
│ Req/Sec   │ 3287   │ 3287   │ 7767   │ 7919   │ 7255.7 │ 1364.07 │ 3286   │
├───────────┼────────┼────────┼────────┼────────┼────────┼─────────┼────────┤
│ Bytes/Sec │ 411 kB │ 411 kB │ 971 kB │ 990 kB │ 907 kB │ 171 kB  │ 411 kB │
└───────────┴────────┴────────┴────────┴────────┴────────┴─────────┴────────┘

Req/Bytes counts sampled once per second.
# of samples: 10

73k requests in 10.02s, 9.07 MB read

after:

┌─────────┬──────┬──────┬───────┬──────┬─────────┬─────────┬───────┐
│ Stat    │ 2.5% │ 50%  │ 97.5% │ 99%  │ Avg     │ Stdev   │ Max   │
├─────────┼──────┼──────┼───────┼──────┼─────────┼─────────┼───────┤
│ Latency │ 0 ms │ 0 ms │ 4 ms  │ 4 ms │ 0.46 ms │ 0.99 ms │ 29 ms │
└─────────┴──────┴──────┴───────┴──────┴─────────┴─────────┴───────┘
┌───────────┬────────┬────────┬─────────┬─────────┬─────────┬─────────┬────────┐
│ Stat      │ 1%     │ 2.5%   │ 50%     │ 97.5%   │ Avg     │ Stdev   │ Min    │
├───────────┼────────┼────────┼─────────┼─────────┼─────────┼─────────┼────────┤
│ Req/Sec   │ 4711   │ 4711   │ 8623    │ 8959    │ 8254.8  │ 1231.47 │ 4708   │
├───────────┼────────┼────────┼─────────┼─────────┼─────────┼─────────┼────────┤
│ Bytes/Sec │ 589 kB │ 589 kB │ 1.08 MB │ 1.12 MB │ 1.03 MB │ 154 kB  │ 589 kB │
└───────────┴────────┴────────┴─────────┴─────────┴─────────┴─────────┴────────┘

Req/Bytes counts sampled once per second.
# of samples: 10

83k requests in 10.02s, 10.3 MB read

src/middleware/node/middleware.ts Outdated Show resolved Hide resolved
src/middleware/node/middleware.ts Show resolved Hide resolved
@@ -15,6 +15,7 @@ export async function verifyAndReceive(
// verify will validate that the secret is not undefined
const matchesSignature = await verify(
state.secret,
// @ts-expect-error verify uses createHmac, which can take Strings and Buffers
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd rather not. It's better to fix this at the source

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wolfy1339
Copy link
Member

Please let other maintainers the time to review this. Can you split the performance patches from this PR and only handle GCF compatibility please

src/middleware/node/get-payload.ts Outdated Show resolved Hide resolved
src/middleware/node/get-payload.ts Show resolved Hide resolved
@wolfy1339
Copy link
Member

wolfy1339 commented Dec 2, 2023

We have 3 active PRs, of which 2 were split off from this one.

Can you incorporate the feedback of this PR into the other PRs?

#939 for the switch to using Buffer instead of string
#937 for the changes to fix compatibility with Google Cloud Functions.

Let's continue on in those more specific PRs

@wolfy1339 wolfy1339 closed this Dec 2, 2023
@Uzlopak
Copy link
Contributor Author

Uzlopak commented Dec 2, 2023

k

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Type: Bug Something isn't working as documented, or is being fixed
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

[BUG]: google-cloud-function, can not verify payload
4 participants