Details
-
Improvement
-
Status: Closed
-
Minor
-
Resolution: Fixed
-
9.2
-
None
Description
Currently, PKIAuthenticationPlugin decorates intra-node requests using an 'onQueue' lifecycle hook, which is triggered when the request is enqueued for processing by the (asynchronous) Jetty http client.
This works great on many systems. However on heavily loaded clusters the time between Jetty "queueing" the request and it actually being sent out can be non-negligible. If this gap becomes wide enough, the TTL encoded into the PKI auth header might have substantially or fully expired by the time the receiving node gets the request.
We should experiment with moving PKI header decoration to the 'onBegin' hook instead, which fires much closer to the actual request-send time on heavily loaded servers.
