This repo contains benchmarks (run with Go v1.24.2) that compare the performance of two CORS middleware libraries:
- the more popular rs/cors (v1.11.1), and
- the more user-friendly jub0bs/cors (v0.5.9).
Run the following commands in your shell (preferably on an idle machine):
git clone https://github.com/jub0bs/cors-benchmarks
cd cors-benchmarks
go test -run ^$ -bench . -count 10 > bench.out
benchstat -col "/mw@(rs-cors jub0bs-cors)" -row "/req" bench.outgoos: darwin
goarch: amd64
pkg: github.com/jub0bs/cors-benchmarks
cpu: Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz
│ rs-cors │ jub0bs-cors │
│ sec/op │ sec/op vs base │
single_vs_actual 621.9n ± 1% 675.8n ± 1% +8.67% (p=0.000 n=10)
multiple_vs_actual 643.4n ± 1% 679.8n ± 2% +5.65% (p=0.000 n=10)
pathological_vs_actual 692.5n ± 1% 798.2n ± 3% +15.27% (p=0.000 n=10)
many_vs_actual 654.4n ± 1% 657.9n ± 2% ~ (p=0.324 n=10)
any_vs_actual 651.3n ± 3% 641.2n ± 4% ~ (p=0.072 n=10)
all_CORS_headers_vs_actual 664.5n ± 2% 739.0n ± 1% +11.20% (p=0.000 n=10)
single_vs_preflight 517.2n ± 2% 490.0n ± 1% -5.26% (p=0.000 n=10)
multiple_vs_preflight 523.6n ± 1% 488.5n ± 1% -6.69% (p=0.000 n=10)
pathological_vs_preflight 520.7n ± 4% 573.2n ± 1% +10.08% (p=0.000 n=10)
many_vs_preflight 477.2n ± 0% 429.9n ± 1% -9.90% (p=0.000 n=10)
any_vs_preflight 507.6n ± 2% 472.1n ± 2% -6.98% (p=0.000 n=10)
ACRH_vs_preflight 481.3n ± 1% 459.1n ± 4% -4.61% (p=0.002 n=10)
all_CORS_headers_vs_preflight 489.4n ± 0% 476.2n ± 1% -2.70% (p=0.000 n=10)
malicious_ACRH_vs_preflight 516.7n ± 1% 458.7n ± 1% -11.23% (p=0.000 n=10)
geomean 563.6n 562.7n -0.15%
│ rs-cors │ jub0bs-cors │
│ B/op │ B/op vs base │
single_vs_actual 1.047Ki ± 0% 1.047Ki ± 0% ~ (p=1.000 n=10) ¹
multiple_vs_actual 1.047Ki ± 0% 1.047Ki ± 0% ~ (p=1.000 n=10) ¹
pathological_vs_actual 1.047Ki ± 0% 1.031Ki ± 0% -1.49% (p=0.000 n=10)
many_vs_actual 1.047Ki ± 0% 1.031Ki ± 0% -1.49% (p=0.000 n=10)
any_vs_actual 1.047Ki ± 0% 1.031Ki ± 0% -1.49% (p=0.000 n=10)
all_CORS_headers_vs_actual 1.062Ki ± 0% 1.078Ki ± 0% +1.47% (p=0.000 n=10)
single_vs_preflight 976.0 ± 0% 944.0 ± 0% -3.28% (p=0.000 n=10)
multiple_vs_preflight 976.0 ± 0% 944.0 ± 0% -3.28% (p=0.000 n=10)
pathological_vs_preflight 960.0 ± 0% 928.0 ± 0% -3.33% (p=0.000 n=10)
many_vs_preflight 960.0 ± 0% 928.0 ± 0% -3.33% (p=0.000 n=10)
any_vs_preflight 976.0 ± 0% 944.0 ± 0% -3.28% (p=0.000 n=10)
ACRH_vs_preflight 968.0 ± 0% 928.0 ± 0% -4.13% (p=0.000 n=10)
all_CORS_headers_vs_preflight 968.0 ± 0% 928.0 ± 0% -4.13% (p=0.000 n=10)
malicious_ACRH_vs_preflight 968.0 ± 0% 928.0 ± 0% -4.13% (p=0.000 n=10)
geomean 1012.9 989.7 -2.29%
¹ all samples are equal
│ rs-cors │ jub0bs-cors │
│ allocs/op │ allocs/op vs base │
single_vs_actual 11.00 ± 0% 11.00 ± 0% ~ (p=1.000 n=10) ¹
multiple_vs_actual 11.00 ± 0% 11.00 ± 0% ~ (p=1.000 n=10) ¹
pathological_vs_actual 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
many_vs_actual 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
any_vs_actual 11.00 ± 0% 11.00 ± 0% ~ (p=1.000 n=10) ¹
all_CORS_headers_vs_actual 11.00 ± 0% 12.00 ± 0% +9.09% (p=0.000 n=10)
single_vs_preflight 8.000 ± 0% 7.000 ± 0% -12.50% (p=0.000 n=10)
multiple_vs_preflight 8.000 ± 0% 7.000 ± 0% -12.50% (p=0.000 n=10)
pathological_vs_preflight 9.000 ± 0% 7.000 ± 0% -22.22% (p=0.000 n=10)
many_vs_preflight 9.000 ± 0% 7.000 ± 0% -22.22% (p=0.000 n=10)
any_vs_preflight 8.000 ± 0% 7.000 ± 0% -12.50% (p=0.000 n=10)
ACRH_vs_preflight 9.000 ± 0% 7.000 ± 0% -22.22% (p=0.000 n=10)
all_CORS_headers_vs_preflight 9.000 ± 0% 7.000 ± 0% -22.22% (p=0.000 n=10)
malicious_ACRH_vs_preflight 9.000 ± 0% 7.000 ± 0% -22.22% (p=0.000 n=10)
geomean 9.683 8.549 -11.71%
¹ all samples are equal
For more details about the benchmark labeled "malicious_ACRH_vs_preflight", see rs/cors#170.