OmniAuth::Builder adds massive performance penalty to each request

[hschne]

We are seeing a massive overhead in request times when using Omniauth middleware - often in the area of ~100ms

Configuration

• Provider Gem: omniauth-google-oauth
• Ruby Version: 2.4.4
• Framework: Rails 5.2.3 / Rack
• Platform: Arch/Ubuntu

Expected Behavior

We've been using Omniauth to some success, however recently we have noticed that using OmniAuth::Builder adds a massive performance penalty. Looking at other issues we have found that OmniAuth's middlware should add nore more than a couple of microseconds to a request.

Actual Behavior

We are seeing performance penalties of several milliseconds, sometimes 'only' ~3ms, sometimes as high as 300ms, sometimes even more. See rack-timer output below .

[rack-timer] OmniAuth::Builder took 752989 us
[rack-timer] Flipper::Middleware::Memoizer took 135694 us
[rack-timer] Browser::Middleware took 260 us
[rack-timer] Bullet::Rack took 125 us
[rack-timer] Rack::TempfileReaper took 21 us
[rack-timer] Rack::ETag took 63 us
[rack-timer] Rack::ConditionalGet took 35 us
[rack-timer] Rack::Head took 18 us
[rack-timer] CatchJsonParseErrors took 14 us
[rack-timer] ActionDispatch::ContentSecurityPolicy::Middleware took 22 us
[rack-timer] ActionDispatch::Session::CookieStore took 185 us
[rack-timer] ActionDispatch::Cookies took 108 us
[rack-timer] ActiveRecord::Migration::CheckPending took 17256 us
[rack-timer] ActionDispatch::Callbacks took 28 us
[rack-timer] ActionDispatch::Reloader took 111 us
[rack-timer] Bugsnag::Rack took 35 us
[rack-timer] ActionDispatch::DebugExceptions took 41 us
[rack-timer] ActionDispatch::ShowExceptions took 40 us
[rack-timer] Rails::Rack::Logger took 14668 us
[rack-timer] Sprockets::Rails::QuietAssets took 15 us
[rack-timer] ActionDispatch::RemoteIp took 21 us
[rack-timer] RequestStore::Middleware took 20 us
[rack-timer] ActionDispatch::RequestId took 63 us
[rack-timer] Rack::MethodOverride took 17 us
[rack-timer] Rack::Runtime took 27 us
[rack-timer] ActiveSupport::Cache::Strategy::LocalCache::Middleware took 31 us
[rack-timer] ActionDispatch::Executor took 145 us
[rack-timer] ActionDispatch::Static took 63 us
[rack-timer] Rack::Sendfile took 20 us
[rack-timer] Rack::Cors took 92 us
[rack-timer] SecureHeaders::Middleware took 311 us
[rack-timer] Rack::MiniProfiler took 790 us
[rack-timer] Webpacker::DevServerProxy took 541 us
[rack-timer] Tasks::Application took 49 us
[rack-timer] RackTimer::Middleware took 19 us

Steps to Reproduce

We are using a configuration similar to this one:

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :google_oauth2,
           Rails.configuration.google_calendar['client_id'],
           Rails.configuration.google_calendar['client_secret'],
           scope: 'calendar profile',
           prompt: 'select_account',
           name: 'google',
           verify_iss: false
end

However, removing the provider does not significantly impact performance. Also upgrading ruby to 2.6.3 as well as downgrading the gem to 1.7.1 did not have any effect.

I'm assuming that this is an issue specific to our environment, so I'm not expecting that this can be easily reproduced. I am still posting this because there might others experiencing similar problems - and who knows, maybe this is a know issue and there is an easy fix ;)

This might be related to #955 as well as #927. For now we are using the workaround from the latter and that works for us.