Fixed #36439: Optimize acheck_password CPU heavy internal hashing process by using a sync_to_async on verify_password.
#19611
+9
−1
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
roelzkie15
force-pushed
the
fix-36439-auth-hashing-performance
branch
from
3750296 to
1bb5279
Compare
roelzkie15
changed the title
acheck_password CPU heavy internal hashing process by using a ThreadPoolExecutoracheck_password CPU heavy internal hashing process by using a ThreadPoolExecutor
roelzkie15
force-pushed
the
fix-36439-auth-hashing-performance
branch
from
b984047 to
c9eec27
Compare
roelzkie15
force-pushed
the
fix-36439-auth-hashing-performance
branch
from
c9eec27 to
d1a1ef1
Compare
roelzkie15
force-pushed
the
fix-36439-auth-hashing-performance
branch
from
d1a1ef1 to
50a6d87
Compare
|
Based on the ticket, a test may not be needed for this patch. |
roelzkie15
force-pushed
the
fix-36439-auth-hashing-performance
branch
from
50a6d87 to
b5354b5
Compare
roelzkie15
changed the title
acheck_password CPU heavy internal hashing process by using a ThreadPoolExecutoracheck_password CPU heavy internal hashing process by using a ThreadPoolExecutor
sarahboyce
reviewed
Jul 15, 2025
django/conf/global_settings.py
Outdated
| @@ -546,6 +546,8 @@ def gettext_noop(s): | |||
|
|
|||
| AUTH_PASSWORD_VALIDATORS = [] | |||
|
|
|||
| CHECK_PASSWORD_EXECUTOR_MAX_WORKERS = None | |||
There was a problem hiding this comment.
We shouldn't add a global setting for something niche within a contrib app
In general adding settings is quite controversial and needs to be discussed and agreed with the wider community
There was a problem hiding this comment.
Thanks for checking. If we don't want to control any of the ThreadPoolExecutor options, we can also rely on its basic instance or maybe create a ThreadPoolExecutor every acheck_password call, depending on the performance.
There was a problem hiding this comment.
👋🏼 @sarahboyce, I made a new performance benchmarking/testing here, and it looks like using sync_to_async without ThreadPoolExecutor is enough to optimize the performance.
I also updated the PR's description.
…n `verify_password`.
roelzkie15
force-pushed
the
fix-36439-auth-hashing-performance
branch
from
b5354b5 to
c591c40
Compare
roelzkie15
changed the title
acheck_password CPU heavy internal hashing process by using a ThreadPoolExecutoracheck_password CPU heavy internal hashing process by using a sync
roelzkie15
changed the title
acheck_password CPU heavy internal hashing process by using a syncacheck_password CPU heavy internal hashing process by using a sync_to_async on verify_password.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Trac ticket number
ticket-36439
Branch description
Conducted several experiments/benchmarks on the performance of theacheck_passwordthat blocks asyncio's event-loop, which is causing a performance bottleneck. Adding aThreadPoolExecutorsignificantly improved the performance gap compared to the test without using it.Also, introduced theCHECK_PASSWORD_EXECUTOR_MAX_WORKERSfor allowing developers to provide a configurable setting for theThreadPoolExecutorinstance. See the updated document on this PR.EDIT:
Please check the new experiments/benchmarks on the performance of the
acheck_passwordthat blocks asyncio's event-loop, which is causing a performance bottleneck by using thesync_to_asyncon theverify_password.This PR targets a patch for v5.2 as mentioned in the ticket.
Checklist
mainbranch.