This repo contains benchmarks (run with Go v1.24.6) that compare the performance of two CORS middleware libraries:
- the more popular rs/cors (v1.11.1), and
- the more user-friendly jub0bs/cors (v0.8.0).
Run the following commands in your shell (preferably on an idle machine):
git clone https://github.com/jub0bs/cors-benchmarks
cd cors-benchmarks
go test -run ^$ -bench . -count 10 > bench.out
benchstat -col "/mw@(rs-cors jub0bs-cors)" -row "/req" bench.outgoos: darwin
goarch: amd64
pkg: github.com/jub0bs/cors-benchmarks
cpu: Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz
│ rs-cors │ jub0bs-cors │
│ sec/op │ sec/op vs base │
single_vs_actual 651.8n ± 3% 688.5n ± 2% +5.62% (p=0.000 n=10)
multiple_vs_actual 662.5n ± 1% 696.4n ± 3% +5.12% (p=0.000 n=10)
pathological_vs_actual 723.1n ± 3% 820.9n ± 2% +13.52% (p=0.000 n=10)
many_vs_actual 681.8n ± 1% 665.5n ± 1% -2.40% (p=0.001 n=10)
any_vs_actual 657.0n ± 1% 645.9n ± 2% -1.70% (p=0.043 n=10)
all_CORS_headers_vs_actual 695.2n ± 1% 767.6n ± 3% +10.41% (p=0.000 n=10)
single_vs_preflight 531.2n ± 2% 501.4n ± 2% -5.62% (p=0.000 n=10)
multiple_vs_preflight 537.6n ± 1% 499.0n ± 2% -7.16% (p=0.000 n=10)
pathological_vs_preflight 530.3n ± 2% 580.4n ± 2% +9.44% (p=0.000 n=10)
many_vs_preflight 492.6n ± 2% 440.1n ± 2% -10.65% (p=0.000 n=10)
any_vs_preflight 526.9n ± 3% 484.0n ± 2% -8.14% (p=0.000 n=10)
ACRH_vs_preflight 497.6n ± 1% 453.4n ± 2% -8.89% (p=0.000 n=10)
all_CORS_headers_vs_preflight 504.8n ± 2% 487.3n ± 3% -3.47% (p=0.003 n=10)
malicious_ACRH_vs_preflight 536.5n ± 1% 467.5n ± 2% -12.88% (p=0.000 n=10)
geomean 582.3n 573.3n -1.54%
│ rs-cors │ jub0bs-cors │
│ B/op │ B/op vs base │
single_vs_actual 1.047Ki ± 0% 1.047Ki ± 0% ~ (p=1.000 n=10) ¹
multiple_vs_actual 1.047Ki ± 0% 1.047Ki ± 0% ~ (p=1.000 n=10) ¹
pathological_vs_actual 1.047Ki ± 0% 1.031Ki ± 0% -1.49% (p=0.000 n=10)
many_vs_actual 1.047Ki ± 0% 1.031Ki ± 0% -1.49% (p=0.000 n=10)
any_vs_actual 1.047Ki ± 0% 1.031Ki ± 0% -1.49% (p=0.000 n=10)
all_CORS_headers_vs_actual 1.062Ki ± 0% 1.078Ki ± 0% +1.47% (p=0.000 n=10)
single_vs_preflight 976.0 ± 0% 944.0 ± 0% -3.28% (p=0.000 n=10)
multiple_vs_preflight 976.0 ± 0% 944.0 ± 0% -3.28% (p=0.000 n=10)
pathological_vs_preflight 960.0 ± 0% 928.0 ± 0% -3.33% (p=0.000 n=10)
many_vs_preflight 960.0 ± 0% 928.0 ± 0% -3.33% (p=0.000 n=10)
any_vs_preflight 976.0 ± 0% 944.0 ± 0% -3.28% (p=0.000 n=10)
ACRH_vs_preflight 968.0 ± 0% 928.0 ± 0% -4.13% (p=0.000 n=10)
all_CORS_headers_vs_preflight 968.0 ± 0% 928.0 ± 0% -4.13% (p=0.000 n=10)
malicious_ACRH_vs_preflight 968.0 ± 0% 928.0 ± 0% -4.13% (p=0.000 n=10)
geomean 1012.9 989.7 -2.29%
¹ all samples are equal
│ rs-cors │ jub0bs-cors │
│ allocs/op │ allocs/op vs base │
single_vs_actual 11.00 ± 0% 11.00 ± 0% ~ (p=1.000 n=10) ¹
multiple_vs_actual 11.00 ± 0% 11.00 ± 0% ~ (p=1.000 n=10) ¹
pathological_vs_actual 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
many_vs_actual 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
any_vs_actual 11.00 ± 0% 11.00 ± 0% ~ (p=1.000 n=10) ¹
all_CORS_headers_vs_actual 11.00 ± 0% 12.00 ± 0% +9.09% (p=0.000 n=10)
single_vs_preflight 8.000 ± 0% 7.000 ± 0% -12.50% (p=0.000 n=10)
multiple_vs_preflight 8.000 ± 0% 7.000 ± 0% -12.50% (p=0.000 n=10)
pathological_vs_preflight 9.000 ± 0% 7.000 ± 0% -22.22% (p=0.000 n=10)
many_vs_preflight 9.000 ± 0% 7.000 ± 0% -22.22% (p=0.000 n=10)
any_vs_preflight 8.000 ± 0% 7.000 ± 0% -12.50% (p=0.000 n=10)
ACRH_vs_preflight 9.000 ± 0% 7.000 ± 0% -22.22% (p=0.000 n=10)
all_CORS_headers_vs_preflight 9.000 ± 0% 7.000 ± 0% -22.22% (p=0.000 n=10)
malicious_ACRH_vs_preflight 9.000 ± 0% 7.000 ± 0% -22.22% (p=0.000 n=10)
geomean 9.683 8.549 -11.71%
¹ all samples are equal
For more details about the benchmark labeled "malicious_ACRH_vs_preflight", see rs/cors#170.