New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 803580 link

Starred by 11 users

Issue metadata

Status: WontFix
Owner:
Closed: Aug 9
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows , Mac
Pri: 2
Type: Bug



Sign in to add a comment

CORS pre-flight and subsequent requests are very slow only on Chrome

Reported by m...@linc-ed.com, Jan 18 2018

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36

Steps to reproduce the problem:
1. Have app.domain.com
2. Have api.domain.com
3. Enable CORS on API to enable access
4. Check responses in DevTools, see OPTIONS and GET requests are taking up to 300ms+

What is the expected behavior?
Response timings should be accurate.

What went wrong?
We are using Go microservices and noticed a big disparity in the time taken between browsers - chrome being the slowest up to a magnitude of 100x.

when we have checked the timings from the backend, responses take at most 10ms, with most being sub 1ms. When checking the timing under devtools the same responses were coming in at ~100ms~1s. 

Did this work before? N/A 

Chrome version: 63.0.3239.132  Channel: stable
OS Version: 10.0
Flash Version: 

In Firefox (and any other browser), the exact same requests return in ~1-20ms as expected.

In trying to diagnose further, we used Telerik's Fiddler to check the actual network response times and confirmed that they were being sent and received by Chrome within our expected timings. The only conclusion we could come to is that something internal to Chrome is slowing the processing of these requests down.

We tried all permutations of `chrome://flags#out-of-blink-cors` and `chrome://flags#enable-site-per-process`, which are the two options which we spotted which seem vaguely relevant.  Nothing seemed to help.

We have also found many Stack Overflow articles about a similar issues that make mention of it being a Chrome bug, but I haven't been able to find it reported here:

- https://stackoverflow.com/questions/46218440/super-slow-preflight-options-in-chrome-only?rq=1
- https://github.com/corydolphin/flask-cors/issues/147
- https://stackoverflow.com/questions/48206992/slow-cors-preflight-options-request-in-chrome
 
optionsChrome.PNG
100 KB View Download
optionsFirefox.PNG
91.2 KB View Download
getChrome.PNG
97.8 KB View Download
getFirefox.PNG
87.2 KB View Download

Comment 1 by m...@linc-ed.com, Jan 18 2018

We've just tested Chrome on MacOS and it doesn't appear to be an issue - so may be limited to Windows.
optionsEdge.PNG
80.4 KB View Download
getEdge.PNG
93.5 KB View Download

Comment 2 by kozy@chromium.org, Jan 18 2018

Cc: eostroukhov@chromium.org
Components: -Platform>DevTools Blink>Network
I believe that issue by itself does not related to Chrome DevTools, forwarded to network.
Labels: Needs-Triage-M63
I'm having a similar problem and I'm on Mac (using NodeJS as a back-end framework, EmberJS as a front-end framework)
Cc: yhirano@chromium.org
Labels: Needs-Feedback
Thank you for reporting.

Can you provide a netlog? https://dev.chromium.org/for-testers/providing-network-details

Comment 6 by m...@linc-ed.com, Jan 25 2018

For visibility: I have emailed the netlog directly to @yhirano.

Thanks!
Project Member

Comment 7 by sheriffbot@chromium.org, Jan 25 2018

Labels: -Needs-Feedback
Thank you for providing more feedback. Adding requester "yhirano@chromium.org" to the cc list and removing "Needs-Feedback" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Components: Internals>Network
@yhirano: Are you investigating the netlog? Otherwise, can you link to the net internals with internal permissions, or set this bug to Restrict-View and upload it here, so someone on the Network team triage rotation can take a look.
Labels: Needs-Feedback

Comment 11 by m...@linc-ed.com, Feb 4 2018

For visibility: I have re-sent the netlog directly to @yhirano, @svaldez and @wangyix.

Thanks!
Project Member

Comment 12 by sheriffbot@chromium.org, Feb 4 2018

Cc: wangyix@chromium.org
Labels: -Needs-Feedback
Thank you for providing more feedback. Adding requester "wangyix@chromium.org" to the cc list and removing "Needs-Feedback" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Sorry for the delay. I haven't seen anything CORS specific from the log so far, so I appreciate Internals>Network eyes.
Attaching the NetLog file I received from matt@.
Given that the netlog was emailed in order to keep it private, can you please urgently remove (or make private) that attachment?
NetLog attachment removed. NetLog can be downloaded here:
https://drive.google.com/file/d/1OifTNnzljeDiMkwPAuf9VxKQAMO-uP0W/view?usp=sharing
Hmm, nothing really stuck out as taking way too long on the NetLog to me as it did on those waterfall screenshots... I wonder what exactly the "Content Received" portion of the waterfall is measuring.

Comment 18 by pau...@linc-ed.com, Feb 21 2018

That's a good question, morlovich@ - I don't think that the "Content Received" portion of the waterfall is so large because the request is slow, as everything else we've done to try to trace the issue shows the requests flying through just as quickly as for other browsers.

Is there any chance you can get somebody from the DevTools team to look at this again and shed some light on what exactly goes into "Content Received" (and perhaps tell us if there's anything we can do to help narrow down where the time is actually being spent, since the netlog wasn't much help there)?
Cc: rsleevi@chromium.org
Components: Blink>SecurityFeature>CORS
Labels: Needs-Feedback
Is it possible to provide a reduction or a test site demonstrating this? This would help further diagnostic triage as well as narrow down the reported platform differences  (from Comment #1)
Owner: yhirano@chromium.org
Status: Assigned (was: Unconfirmed)
assigning to yhirano@ so the issue doesn't keep popping up for triage
Quick ping for a reduction or test site which would help further debugging (as requested in comment #19).
Components: -Internals>Network
Removing the Internals>Network label - requests in the log generally take under 80 milliseconds, with the majority of that either waiting to establish a connection or waiting on headers.  A couple are delayed by up to 30 milliseconds from the resource scheduler, but nothing going on that explains the log.  There are two 260 millisecond requests, but both of those were blocked for 180 milliseconds on headers (And 40 milliseconds on the renderer, to validate if the an initial redirect request should be followed).

None of this points to a network issue.
Labels: OOR-CORS
Status: WontFix (was: Assigned)
There have been no response from the reporter for two months.
I'm experiencing this problem too. If you're waiting for feedback or as described above a test site I could perhaps provide one if it means this would continue to be investigated? I've replicated this on a couple of machines (all mac os though), in private browsing, and on multiple websites.

Comment 26 by ood...@gmail.com, May 11 2018

Also still experiencing this problem. I can provide a test site.

Comment 27 by m...@linc-ed.com, May 13 2018

Hi Team,

Sorry we haven't responded - we didn't want to clog up the ticket.

@paul.n has tried to reproduce the issue a couple of times, but we haven't been able to create a solid case. In our case we have a number of factors in play which has made it harder to deduce. Also, due to our development cycle frontend performance tuning is pegged in for a later date. 

If someone (@ben/@ood?) has a solid reproducible test case are you able to link it here please? Then we can all try to reproduce and report the results. :)

Cc: toyoshim@chromium.org
Labels: OS-Mac
Status: Assigned (was: WontFix)
We are planning to replace all CORS-preflight implementation. So, I'm not sure if we should pay much attention to improve current implementation. But definitely, if we could have a simple test to check performance, it would be helpful.
toyoshim: Is there a design doc available for that to review?
Yes, here; https://docs.google.com/document/d/1JNmUcvbw2UcjfdI2uyUpveHXCbae-DQ1n8d_sVs5fLg/edit?usp=sharing

New CORS-preflight implementation is already in //services/network/cors.
I'll appreciate a reproducible test case.
I can confirm this behavior. We're seeing, in some cases, an extra 6 seconds to resolve an OPTIONS request. This is not present in any other browser or HTTP client.

> We are planning to replace all CORS-preflight implementation. So, I'm not sure if we should pay much attention to improve current implementation.

Frankly, this is a careless response, especially for a project that so many companies depend on. Our application's performance was reduced by 120X, which has a meaningful impact to our business. I truly do not understand the lack of urgency for something that is so easily reproducible and wide spread.
I'll appreciate a reproducible test case.
Status: WontFix (was: Assigned)
Unable to reproduce.

Sign in to add a comment