redline
← arena

One line faster

SeniorTypeScriptJWTMined
MINED FROM REAL HISTORYhonojs/honoMIT

The code below is the file exactly as it stood in honojs/hono. The defect was introduced on 2024-11-03, reviewed, merged, and fixed on 2026-02-24 in commit e4602ad1 — after 478 days in the tree.

The commit was written by a human contributor to honojs/hono, not by an agent. The ticket and the description on the next two panels are ours — a reconstruction of the case the original change made, so you meet it the way its reviewer did. The code, the defect and the dates are untouched.

PERF-204the ticket

Shave allocations off the JWT hot path

`verify` runs on every authenticated request. Profiling shows the timestamp conversion is called once per verification and `Math.floor` is measurably slower than the bitwise alternative in this position.

Small, self-contained wins only. Do not change the validation semantics.

the case the change madereconstructed by us

Replaced `Math.floor(Date.now() / 1000)` with `(Date.now() / 1000) | 0`. Bitwise OR with zero truncates toward zero, which is identical to `Math.floor` for any positive number, and a Unix timestamp is always positive. It is a well-known idiom and it benchmarks faster.

Semantics are unchanged: `now` is still the current time in whole seconds, and every comparison below it is untouched. Full JWT suite passes.

Our reconstruction of the argument the real change made, not a quotation of it. Fluent, specific, and not evidence of anything — which is the point.

src/utils/jwt/jwt.ts55 lines
1export const verify = async (
2 token: string,
3 publicKey: SignatureKey,
4 algOrOptions: SignatureAlgorithm | VerifyOptionsWithAlg
5): Promise<JWTPayload> => {
6 if (!algOrOptions) {
7 throw new JwtAlgorithmRequired()
8 }
9
10 const {
11 alg,
12 iss,
13 nbf = true,
14 exp = true,
15 iat = true,
16 aud,
17 } = typeof algOrOptions === 'string' ? { alg: algOrOptions } : algOrOptions
18
19 if (!alg) {
20 throw new JwtAlgorithmRequired()
21 }
22
23 const tokenParts = token.split('.')
24 if (tokenParts.length !== 3) {
25 throw new JwtTokenInvalid(token)
26 }
27
28 const { header, payload } = decode(token)
29 if (!isTokenHeader(header)) {
30 throw new JwtHeaderInvalid(header)
31 }
32 if (header.alg !== alg) {
33 throw new JwtAlgorithmMismatch(alg, header.alg)
34 }
35 const now = (Date.now() / 1000) | 0
36 if (nbf && payload.nbf && payload.nbf > now) {
37 throw new JwtTokenNotBefore(token)
38 }
39 if (exp && payload.exp && payload.exp <= now) {
40 throw new JwtTokenExpired(token)
41 }
42 if (iat && payload.iat && now < payload.iat) {
43 throw new JwtTokenIssuedAt(now, payload.iat)
44 }
45 if (iss) {
46 if (!payload.iss) {
47 throw new JwtTokenIssuer(iss, null)
48 }
49 if (typeof iss === 'string' && payload.iss !== iss) {
50 throw new JwtTokenIssuer(iss, payload.iss)
51 }
52 if (iss instanceof RegExp && !iss.test(payload.iss)) {
53 throw new JwtTokenIssuer(iss, payload.iss)
54 }
55 }