-
Notifications
You must be signed in to change notification settings - Fork 1.2k
Description
Describe the bug
UUID is backed by SecureRandom and because of the security sensitive nature of this randomness source, is backed by the blocking /dev/random. The default sun.security.provider.NativePRNG is also not thread safe, so the call to engineNextBytes occurs in a synchronized block.
That means in the cases where query concurrency exhausts the available entropy, queries will block on the randomness source, and each other due to the monitor.
To Reproduce
Seen in the real world, unclear on the conditions that lead to this being a problem on this host, but it runs upwards of 1k queries per second:
A counter, a timestamp mixed with some other source (such as the identityHashCode of the GraphQL instance), etc. may be a better choice to avoid SecureRandom.