cache compiled globs

pkg/op/auth_request.go

@@ -9,7 +9,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/gobwas/glob"
 	"github.com/gorilla/mux"
 
 	httphelper "github.com/zitadel/oidc/pkg/http"
@@ -283,7 +282,7 @@ func checkURIAginstRedirects(client Client, uri string) error {
 	}
 	if globClient, ok := client.(HasRedirectGlobs); ok {
 		for _, uriGlob := range globClient.RedirectURIGlobs() {
-			matcher, err := glob.Compile(uriGlob)
+			matcher, err := CompileGlob(uriGlob)
 			if err != nil {
 				return oidc.ErrServerError().WithParent(err)
 			}

pkg/op/glob_cache.go

@@ -0,0 +1,32 @@
+package op
+
+import (
+	"github.com/gobwas/glob"
+	lru "github.com/hashicorp/golang-lru"
+)
+
+var globCache *lru.ARCCache
+
+func init() {
+	var err error
+	globCache, err = lru.NewARC(10000)
+	if err != nil {
+		panic(err)
+	}
+}
+
+type cacheEntry struct {
+	compiled glob.Glob
+	err      error
+}
+
+func CompileGlob(s string) (glob.Glob, error) {
+	cachedRaw, ok := globCache.Get(s)
+	if ok {
+		cached := cachedRaw.(cacheEntry)
+		return cached.compiled, cached.err
+	}
+	compiled, err := glob.Compile(s)
+	globCache.Add(s, cacheEntry{compiled: compiled, err: err})
+	return compiled, err
+}

pkg/op/glob_cache_test.go

@@ -0,0 +1,44 @@
+package op_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/zitadel/oidc/pkg/op"
+)
+
+func TestCompileGlob(t *testing.T) {
+	cases := []struct {
+		glob        string
+		uri         string
+		expectError bool
+		expectMatch bool
+	}{
+		{
+			glob:        "http://example.com/foo/*",
+			uri:         "http://example.com/foo/index.html",
+			expectMatch: true,
+		},
+		{
+			glob:        "http://example.com/foo/*",
+			uri:         "http://example.com/index.html",
+			expectMatch: false,
+		},
+		{
+			glob:        "http://example.com/foo/[xl",
+			expectError: true,
+		},
+	}
+	for _, tc := range cases {
+		t.Logf("glob: %s", tc.glob)
+		compiled, err := op.CompileGlob(tc.glob)
+		if tc.expectError {
+			assert.Error(t, err, "compile")
+			return
+		}
+		require.NoError(t, err, "compile")
+		assert.Equal(t, tc.expectMatch, compiled.Match(tc.uri), tc.uri)
+	}
+}

pkg/op/session.go

@@ -5,8 +5,6 @@ import (
 	"net/http"
 	"net/url"
 
-	"github.com/gobwas/glob"
-
 	httphelper "github.com/zitadel/oidc/pkg/http"
 	"github.com/zitadel/oidc/pkg/oidc"
 )
@@ -102,7 +100,7 @@ func ValidateEndSessionPostLogoutRedirectURI(postLogoutRedirectURI string, clien
 	}
 	if globClient, ok := client.(HasRedirectGlobs); ok {
 		for _, uriGlob := range globClient.PostLogoutRedirectURIGlobs() {
-			matcher, err := glob.Compile(uriGlob)
+			matcher, err := CompileGlob(uriGlob)
 			if err != nil {
 				return oidc.ErrServerError().WithParent(err)
 			}