Project

General

Profile

Actions

Bug #16720

open

WebGUI performance degradation caused by redundant password hashing

Added by Christian McDonald 1 day ago. Updated about 10 hours ago.

Status:
Waiting on Merge
Priority:
Urgent
Category:
Web Interface
Target version:
Start date:
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
26.03
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

Several expensive password hashing operations are performed on every page load, resulting in a noticeable degradation in WebGUI performance. The impact is most severe on low-end hardware such as the Netgate 1100 and 2100. This slowdown has become progressively worse as pfSense has adopted stronger hashing algorithms over the years.

The overhead of these redundant checks is now significant. On every page load the system verifies that the logged-in user’s password is neither equal to their username nor to the factory default password (“pfsense”). Both checks require hashing the username and “pfsense” strings and comparing them against the stored password hash. When a non-admin user with sufficient privileges to change the admin account password, the same checks are also performed against the admin account.

Reference: https://forum.netgate.com/topic/200216/webgui-performance-related-to-password-hash-strength-improved-webgui-speed-by-lowering-hash.-why

Actions #1

Updated by Christian McDonald about 10 hours ago

  • Status changed from In Progress to Waiting on Merge
Actions

Also available in: Atom PDF