authorizationCache has no size bound between resets
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- node.js, typescript
- Domain
- backend, performance
Research direction
Start by reading security/auth.ts and locate authorizationCache, its invalidation paths, and periodic reset tick. Add a bounded eviction policy or sweep expired authExpiresAt entries there; run the relevant authentication tests and verify the cache stays bounded or expired entries are removed.
Written by the indexing model from the issue text.
Description
authorizationCache in security/auth.ts is a Map keyed by the full Authorization header. It is replaced on any user/role invalidation and on its periodic reset, but has no size bound in between. Clients that rotate Bearer tokens often (short-lived access tokens, many clients) add one entry per distinct token until the next reset. Expired entries are only evicted when the same header is seen again.
Impact is memory growth bounded by the token rate times the reset interval, per worker. Basic credentials and Harper operation tokens behave the same; component Bearer validators (server.registerBearerValidator, in review) add another source of rotating headers.
Fix direction: cap the map (drop the oldest entries past a size limit), or sweep expired authExpiresAt entries on the periodic reset tick.
Found by the pre-push review of the registerBearerValidator branch.
Review-Deferral: a6a257702252e7a8 severity=nit category=reliability
🤖 Generated by Claude Code (Claude Opus 5.5); posted via @kriszyp.
- Dominant language
- JavaScript
- Stars
- 90
- Forks
- 15
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 328
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from HarperFast/harper
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
HarperFast/harper#3330 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
HarperFast/harper#3304 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
HarperFast/harper#3299 ·
Maintainers usually reply within 1 day
-
CI: the LMDB unit leg runs no unitTests/server suite, so MQTT durable-session tests never run on LMDBMay be free again @sudarshan24-10 claimed this 10 days ago, and no pull request is open. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
HarperFast/harper#3275 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
HarperFast/harper#3261 · 1 comment ·
Maintainers usually reply within 1 day
All issues in HarperFast/harper
Similar issues
-
Add: &TV LogoOpencheck:passed logos:add
Difficulty 1/5 Under an hour Newbie friendliness 74/100
-
BUG: Appointment time renders blank and PM appointment slots miscalculate vertical position in CalendarScreenPossibly taken @aryanpatil-07 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
AOSSIE-Org/BabyNest#297 · 1 comment ·
Maintainers usually reply within 1 day
-
Onboarding form: instructor radio never pre-selected "Yes" (permission vs permissions typo)Possibly taken @ThakuraAnki claimed this today. Openbug
Difficulty 1/5 Under an hour Newbie friendliness 72/100
WikiEducationFoundation/WikiEduDashboard#7235 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
-
Component: Frontend Component: Web Component Type: Maintenance
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
it-at-m/refarch-templates#1944 ·
Maintainers usually reply within 2 days