This repo contains benchmarks (run with Go v1.25.2) that compare the performance of two CORS middleware libraries:
- the more popular rs/cors (v1.11.1), and
- the more user-friendly jub0bs/cors (v0.9.2).
Run the following commands in your shell (preferably on an idle machine):
git clone https://github.com/jub0bs/cors-benchmarks
cd cors-benchmarks
go test -run ^$ -bench . -count 10 > bench.out
benchstat -col "/mw@(rs-cors jub0bs-cors)" -row "/req" bench.outgoos: darwin
goarch: amd64
pkg: github.com/jub0bs/cors-benchmarks
cpu: Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz
│ rs-cors │ jub0bs-cors │
│ sec/op │ sec/op vs base │
single_vs_actual 653.1n ± 1% 682.0n ± 1% +4.42% (p=0.001 n=10)
multiple_vs_actual 657.8n ± 1% 680.5n ± 1% +3.45% (p=0.000 n=10)
pathological_vs_actual 719.3n ± 1% 793.1n ± 1% +10.27% (p=0.000 n=10)
many_vs_actual 670.0n ± 1% 652.6n ± 1% -2.59% (p=0.000 n=10)
any_vs_actual 644.4n ± 1% 635.1n ± 1% -1.44% (p=0.001 n=10)
all_CORS_headers_vs_actual 684.1n ± 2% 743.6n ± 1% +8.70% (p=0.000 n=10)
single_vs_preflight 532.4n ± 1% 494.6n ± 1% -7.08% (p=0.000 n=10)
multiple_vs_preflight 536.6n ± 1% 488.3n ± 1% -9.01% (p=0.000 n=10)
pathological_vs_preflight 529.3n ± 0% 570.3n ± 1% +7.75% (p=0.000 n=10)
many_vs_preflight 492.1n ± 4% 430.6n ± 1% -12.52% (p=0.000 n=10)
any_vs_preflight 519.0n ± 1% 475.7n ± 1% -8.35% (p=0.000 n=10)
ACRH_vs_preflight 492.4n ± 1% 448.0n ± 1% -9.03% (p=0.000 n=10)
all_CORS_headers_vs_preflight 501.0n ± 0% 473.6n ± 1% -5.46% (p=0.000 n=10)
malicious_ACRH_vs_preflight 525.9n ± 1% 463.4n ± 1% -11.88% (p=0.000 n=10)
geomean 577.4n 562.2n -2.63%
│ rs-cors │ jub0bs-cors │
│ B/op │ B/op vs base │
single_vs_actual 1.047Ki ± 0% 1.047Ki ± 0% ~ (p=1.000 n=10) ¹
multiple_vs_actual 1.047Ki ± 0% 1.047Ki ± 0% ~ (p=1.000 n=10) ¹
pathological_vs_actual 1.047Ki ± 0% 1.031Ki ± 0% -1.49% (p=0.000 n=10)
many_vs_actual 1.047Ki ± 0% 1.031Ki ± 0% -1.49% (p=0.000 n=10)
any_vs_actual 1.047Ki ± 0% 1.031Ki ± 0% -1.49% (p=0.000 n=10)
all_CORS_headers_vs_actual 1.062Ki ± 0% 1.078Ki ± 0% +1.47% (p=0.000 n=10)
single_vs_preflight 976.0 ± 0% 944.0 ± 0% -3.28% (p=0.000 n=10)
multiple_vs_preflight 976.0 ± 0% 944.0 ± 0% -3.28% (p=0.000 n=10)
pathological_vs_preflight 960.0 ± 0% 928.0 ± 0% -3.33% (p=0.000 n=10)
many_vs_preflight 960.0 ± 0% 928.0 ± 0% -3.33% (p=0.000 n=10)
any_vs_preflight 976.0 ± 0% 944.0 ± 0% -3.28% (p=0.000 n=10)
ACRH_vs_preflight 968.0 ± 0% 928.0 ± 0% -4.13% (p=0.000 n=10)
all_CORS_headers_vs_preflight 968.0 ± 0% 928.0 ± 0% -4.13% (p=0.000 n=10)
malicious_ACRH_vs_preflight 968.0 ± 0% 928.0 ± 0% -4.13% (p=0.000 n=10)
geomean 1012.9 989.7 -2.29%
¹ all samples are equal
│ rs-cors │ jub0bs-cors │
│ allocs/op │ allocs/op vs base │
single_vs_actual 11.00 ± 0% 11.00 ± 0% ~ (p=1.000 n=10) ¹
multiple_vs_actual 11.00 ± 0% 11.00 ± 0% ~ (p=1.000 n=10) ¹
pathological_vs_actual 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
many_vs_actual 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
any_vs_actual 11.00 ± 0% 11.00 ± 0% ~ (p=1.000 n=10) ¹
all_CORS_headers_vs_actual 11.00 ± 0% 12.00 ± 0% +9.09% (p=0.000 n=10)
single_vs_preflight 8.000 ± 0% 7.000 ± 0% -12.50% (p=0.000 n=10)
multiple_vs_preflight 8.000 ± 0% 7.000 ± 0% -12.50% (p=0.000 n=10)
pathological_vs_preflight 9.000 ± 0% 7.000 ± 0% -22.22% (p=0.000 n=10)
many_vs_preflight 9.000 ± 0% 7.000 ± 0% -22.22% (p=0.000 n=10)
any_vs_preflight 8.000 ± 0% 7.000 ± 0% -12.50% (p=0.000 n=10)
ACRH_vs_preflight 9.000 ± 0% 7.000 ± 0% -22.22% (p=0.000 n=10)
all_CORS_headers_vs_preflight 9.000 ± 0% 7.000 ± 0% -22.22% (p=0.000 n=10)
malicious_ACRH_vs_preflight 9.000 ± 0% 7.000 ± 0% -22.22% (p=0.000 n=10)
geomean 9.683 8.549 -11.71%
¹ all samples are equal
For more details about the benchmark labeled "malicious_ACRH_vs_preflight", see rs/cors#170.