100% CPU when revoking tokens

Confirm you’ve already contributed to this project or that you sponsor it

• I confirm I’m a sponsor or a contributor

Version

4.x

Describe the bug

My server sometimes goes 100% CPU and I’ve noticed the correlation with 2 logs

The token '{GUID}' was successfully revoked.

and

An exception occurred in the database while saving changes for context type 'Crpg.WebApi.Identity.OpenIddictDbContext'.
Microsoft.EntityFrameworkCore.DbUpdateConcurrencyException: Conflicts were detected for instance of entity type 'OpenIddictEntityFrameworkCoreToken' on the concurrency token properties {'ConcurrencyToken'}. Consider using 'DbContextOptionsBuilder.EnableSensitiveDataLogging' to see the conflicting values.
 at Microsoft.EntityFrameworkCore.InMemory.Storage.Internal.InMemoryTable`1.ThrowUpdateConcurrencyException(IUpdateEntry entry, Dictionary`2 concurrencyConflicts, IDiagnosticsLogger`1 updateLogger)
 at Microsoft.EntityFrameworkCore.InMemory.Storage.Internal.InMemoryTable`1.Update(IUpdateEntry entry, IDiagnosticsLogger`1 updateLogger)
 at Microsoft.EntityFrameworkCore.InMemory.Storage.Internal.InMemoryStore.ExecuteTransaction(IList`1 entries, IDiagnosticsLogger`1 updateLogger)
 at Microsoft.EntityFrameworkCore.InMemory.Storage.Internal.InMemoryDatabase.SaveChangesAsync(IList`1 entries, CancellationToken cancellationToken)
 at Microsoft.EntityFrameworkCore.ChangeTracking.Internal.StateManager.SaveChangesAsync(IList`1 entriesToSave, CancellationToken cancellationToken)
 at Microsoft.EntityFrameworkCore.ChangeTracking.Internal.StateManager.SaveChangesAsync(StateManager stateManager, Boolean acceptAllChangesOnSuccess, CancellationToken cancellationToken)
 at Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync(Boolean acceptAllChangesOnSuccess, CancellationToken cancellationToken)""","An exception occurred in the database while saving changes for context type 'Crpg.WebApi.Identity.OpenIddictDbContext'.Microsoft.EntityFrameworkCore.DbUpdateConcurrencyException: Conflicts were detected for instance of entity type 'OpenIddictEntityFrameworkCoreToken' on the concurrency token properties {'ConcurrencyToken'}. Consider using 'DbContextOptionsBuilder.EnableSensitiveDataLogging' to see the conflicting values. at Microsoft.EntityFrameworkCore.InMemory.Storage.Internal.InMemoryTable`1.ThrowUpdateConcurrencyException(IUpdateEntry entry, Dictionary`2 concurrencyConflicts, IDiagnosticsLogger`1 updateLogger) at Microsoft.EntityFrameworkCore.InMemory.Storage.Internal.InMemoryTable`1.Update(IUpdateEntry entry, IDiagnosticsLogger`1 updateLogger) at Microsoft.EntityFrameworkCore.InMemory.Storage.Internal.InMemoryStore.ExecuteTransaction(IList`1 entries, IDiagnosticsLogger`1 updateLogger) at Microsoft.EntityFrameworkCore.InMemory.Storage.Internal.InMemoryDatabase.SaveChangesAsync(IList`1 entries, CancellationToken cancellationToken) at Microsoft.EntityFrameworkCore.ChangeTracking.Internal.StateManager.SaveChangesAsync(IList`1 entriesToSave, CancellationToken cancellationToken) at Microsoft.EntityFrameworkCore.ChangeTracking.Internal.StateManager.SaveChangesAsync(StateManager stateManager, Boolean acceptAllChangesOnSuccess, CancellationToken cancellationToken) at Microsoft.EntityFrameworkCore.DbContext.SaveChangesAsync(Boolean acceptAllChangesOnSuccess, CancellationToken cancellationToken)

Here are the logs filtering on “OpenIddict” or “error”: openiddict-logs.csv.

For info, I’m using the in-memory provider. I’m thinking that maybe the token revocation expects an index so it’s super slow with this provider?

To reproduce

Hard to reproduce. Use this program and make it run for days https://github.com/verdie-g/crpg/blob/844795b4c2b6c32431a4ff6bf75ce938a9a9d72e/src/WebApi/Program.cs

Exceptions (if any)

No response

[kevinchalet]

@verdie-g makes a lot of sense (tho’ it’s not clear to me why only a single user seems to be affected).

Given it’s likely not an OpenIddict issue at this point, I’m going to close this ticket. I opened https://github.com/openiddict/openiddict-core/issues/1856 to track adding new store methods in 5.0 to make the token chain revocation process much more efficient.

Cheers.

[kevinchalet]

No, the replay detection/revocation mechanism only kicks in when using an authorization code or refresh token (i.e not when using the client credentials grant)