Skip to content

INTPYTHON-676: Adding security and optimization to cache collections #343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

linted
Copy link

@linted linted commented Jul 17, 2025

Add HMAC signing of pickled cache data. This implementation uses Blake2b from hashlib to avoid introducing new 3rd party dependencies.

HMAC introduces some overhead to performance, but for cache entries less then 32kb the impact is less then 100ns. For cache entries larger then 1MB, signing can introduce up to 2ms of latency. For BSON serializable types (int, str, bytes), pickling and signing are skipped, and the values are stored in the cache collection directly.

The feature is easily disabled by setting "ENABLE_SIGNING" = False within the CACHE configuration.

Introduced three new cache config options:

  • ENABLE_SIGNING - boolean value to turn HMAC signing on or off. Defaults to True (on)
  • SALT - optional 16 character string to salt HMAC signatures with
  • KEY - optional string to use when performing HMAC operations. This can be up to 64 charcers, and if not provided, SECRET_KEY is used instead.

If the cache fails to validate a signature SuspiciousOperation will be thrown.

@aclark4life
Copy link
Collaborator

Thanks! OK to close #336 ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants