Investigate performance of Antiforgery

[BrennanConroy]

• We should add some antiforgery E2E benchmarks to our regular aspnet/benchmark runs
• Find and fix low-hanging fruit
  • e.g.

    aspnetcore/src/Antiforgery/src/Internal/DefaultAntiforgeryTokenGenerator.cs

    Line 62 in 50c9562

    requestToken.ClaimUid = GetClaimUidBlob(_claimUidExtractor.ExtractClaimUid(httpContext.User));

    and

    aspnetcore/src/Antiforgery/src/Internal/DefaultAntiforgeryTokenGenerator.cs

    Line 145 in 50c9562

    currentClaimUid = GetClaimUidBlob(_claimUidExtractor.ExtractClaimUid(httpContext.User));

• Affect on Routing especially for non-form POSTs Set form options for form-based request types #50016 (comment)

[yunusefendi52]

I am seeing some performance bottleneck using when using antiforgery as well, I trace using dotnet trace.

Not sure if it's really because of antiforgery it self or data protection

Thanks for contacting us.

We're moving this issue to the .NET 9 Planning milestone for future evaluation / consideration. We would like to keep this around to collect more feedback, which can help us with prioritizing this work. We will re-evaluate this issue, during our next planning meeting(s).
If we later determine, that the issue has no community involvement, or it's very rare and low-impact issue, we will close it - so that the team can focus on more important and high impact issues.
To learn more about what to expect next and how this issue will be handled you can read more about our triage process here.

[DeagleGross]

Created an issue for asp.net perf diff in DataProtection layer between windows and linux: #59287