Fixes issue where 2 clients from the same service would share a signature cache. #1054
Conversation
…ture cache. This issue would result in the same signed key to be used by 2 different clients if they were configured to use the same region and accessKeyId. (Very unlikely if possible). This issue also resulted in the signature cache being cleared anytime the client making a request was alternated with another client of the same service type. Fixes #1020 Fixes #1052
| @@ -117,13 +118,13 @@ AWS.Signers.V4 = inherit(AWS.Signers.RequestSigner, { | |||
| return AWS.util.crypto.hmac(kCredentials, this.stringToSign(datetime), 'hex'); | |||
| } | |||
|
|
|||
| cachedSecret[this.serviceName] = { | |||
| cachedSecret[cacheIdentifier] = { | |||
| region: this.request.region, date: date, | |||
| key: kCredentials, akid: credentials.accessKeyId | |||
| }; | |||
There was a problem hiding this comment.
We should put a maximum size constraint on cachedSecret. Before, there was only one cache per service (and only the last signature key for that service is kept), so the cache was necessarily bounded by the number of services. There is no upper bound on the number of service clients generated. Some applications could be generating a new service client for every request. The service client objects get garbage-collected eventually, but the cache doesn't and could grow to millions of objects fairly quickly and hog a lot of memory. Perhaps we could have a cacheIdentifierQueue of some sort so that when it's length reaches a certain number, we can get the oldest cacheIdentifier and delete it from cachedSecret.
There was a problem hiding this comment.
Great point! I like the idea of having a queue keep track of what should be removed from cache first.
|
Code has been updated to only cache up to 50 service clients at a time. |
|
🚢 |
|
This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs and link to relevant comments in this thread. |
This issue would result in the same signed key to be used by 2 different clients if they were configured to use the same region and accessKeyId. (Very unlikely if possible).
This issue also resulted in the signature cache being cleared anytime the client making a request was alternated with another client of the same service type.
Fixes #1020
Fixes #1052
/cc @LiuJoyceC
I added a unique client id to each client created to differentiate them when caching the signature. It's hidden for now as I didn't want it to be easy for users to find, but I am open to creating a method on Service to return the ID as well.