Symfony 3 - Firewall Listener Performance at Login

Question

Replied to my own question and posted it here for reference to others.

---

Setup

My application is really fast out of the box, running:

• Symfony 3 with Doctrine2
• PHP 5.6.* with CGI/FastCGI as a PHP handler (not even php 7)
• mySQL 5.6.*

Then, it is optimised further with:

• Zend OpCache to get faster PHP execution through opcode caching and optimization
• Memcached to store user sessions in memcached
• Memcached to act as a metadata cache driver and a query cache driver for doctrine 2

The bottleneck

However, one route is very slow and that is the fos_user_security_check route when I authenticate via the login form.

It shows Symfony\Bundle\SecurityBundle\EventListener\FirewallListener as the culprit - though I am not sure why that is because this route lights up quickly on my local machine but doesn't on my production machine.

Things that I have tried

• [x] To use Memcached to cache PHP sessions -> no difference
• [x] To use Memcached to cache Doctrine stuff -> no difference
• [x] To run mysql with skip-name-resolve -> no difference

Related posts I have seen

• SecurityBundle Configuration ("security")

• What is the Symfony Firewall doing that takes so long?

• Why does the Symfony 2 firewall take so long to load?

Answer 1

Two words!! "Encryption Algorithm".

There is a compromise between 'speed' and 'security'.

See Using the pbkdf2 Encoder Security and Speed.

---

An example to show how 2 different encryption may affect speed.

Configuration A:

# Login in 3.5s in my case
security:
    FOS\UserBundle\Model\UserInterface:

        # . Use `bcrypt` algorithm
        algorithm: bcrypt
        cost: 13

Configuration B:

# Login in 400ms in my case
security:
    FOS\UserBundle\Model\UserInterface:
    # . Use `pdkdf2` algorithm
    algorithm:            pbkdf2
    hash_algorithm:       sha512
    encode_as_base64:     true
    iterations:           1000
    key_length:           40

Note, you will have to recreate your user in your database to test different encryption mechanisms.

---

This explains:

... this route lights up quickly on my local machine but doesn't on my production machine. 

• My local machine has a Intel Core i7-7820HQ @ 2.90GHz
• My production machine has a Intel Xeon E5-2620 v2 @ 2.10GHz