1.2.1 Performance issue

[Payn]

After updating from 1.1.1 to 1.2.1 (nothing else changed), our test runs started to take 2x longer.
Enabling debug logs reveals something started causing ~300ms delay between these individual SELECTs in every token request.

v1.1.1

[2026-07-23 10:53:55.221] request.INFO: Matched route "api_oauth2_token". {"route":"api_oauth2_token","route_parameters":{"_route":"api_oauth2_token","_controller":"league.oauth2_server.controller.token::indexAction"},"request_uri":"https://localhost/api/oauth-token","method":"POST"} []
[2026-07-23 10:53:55.274] doctrine.DEBUG: Executing statement: SELECT t0.name AS name_1, t0.secret AS secret_2, t0.redirect_uris AS redirect_uris_3, t0.grants AS grants_4, t0.scopes AS scopes_5, t0.active AS active_6, t0.allow_plain_text_pkce AS allow_plain_text_pkce_7, t0.identifier AS identifier_8 FROM oauth2_client t0 WHERE t0.identifier = ? LIMIT 1 (parameters: array{"1":"xxx"}, types: array{"1":0}) {"sql":"SELECT t0.name AS name_1, t0.secret AS secret_2, t0.redirect_uris AS redirect_uris_3, t0.grants AS grants_4, t0.scopes AS scopes_5, t0.active AS active_6, t0.allow_plain_text_pkce AS allow_plain_text_pkce_7, t0.identifier AS identifier_8 FROM oauth2_client t0 WHERE t0.identifier = ? LIMIT 1","params":{"1":"xxx"},"types":{"1":{"Doctrine\\DBAL\\ParameterType":0}}} []
[2026-07-23 10:53:55.275] doctrine.DEBUG: Executing statement: SELECT t0.name AS name_1, t0.secret AS secret_2, t0.redirect_uris AS redirect_uris_3, t0.grants AS grants_4, t0.scopes AS scopes_5, t0.active AS active_6, t0.allow_plain_text_pkce AS allow_plain_text_pkce_7, t0.identifier AS identifier_8 FROM oauth2_client t0 WHERE t0.identifier = ? LIMIT 1 (parameters: array{"1":"xxx"}, types: array{"1":0}) {"sql":"SELECT t0.name AS name_1, t0.secret AS secret_2, t0.redirect_uris AS redirect_uris_3, t0.grants AS grants_4, t0.scopes AS scopes_5, t0.active AS active_6, t0.allow_plain_text_pkce AS allow_plain_text_pkce_7, t0.identifier AS identifier_8 FROM oauth2_client t0 WHERE t0.identifier = ? LIMIT 1","params":{"1":"xxx"},"types":{"1":{"Doctrine\\DBAL\\ParameterType":0}}} []
[2026-07-23 10:53:55.275] doctrine.DEBUG: Executing statement: SELECT t0.name AS name_1, t0.secret AS secret_2, t0.redirect_uris AS redirect_uris_3, t0.grants AS grants_4, t0.scopes AS scopes_5, t0.active AS active_6, t0.allow_plain_text_pkce AS allow_plain_text_pkce_7, t0.identifier AS identifier_8 FROM oauth2_client t0 WHERE t0.identifier = ? LIMIT 1 (parameters: array{"1":"xxx"}, types: array{"1":0}) {"sql":"SELECT t0.name AS name_1, t0.secret AS secret_2, t0.redirect_uris AS redirect_uris_3, t0.grants AS grants_4, t0.scopes AS scopes_5, t0.active AS active_6, t0.allow_plain_text_pkce AS allow_plain_text_pkce_7, t0.identifier AS identifier_8 FROM oauth2_client t0 WHERE t0.identifier = ? LIMIT 1","params":{"1":"xxx"},"types":{"1":{"Doctrine\\DBAL\\ParameterType":0}}} []
[2026-07-23 10:53:55.277] doctrine.DEBUG: Executing statement: SELECT t0.identifier AS identifier_1, t0.expiry AS expiry_2, t0.user_identifier AS user_identifier_3, t0.scopes AS scopes_4, t0.revoked AS revoked_5, t0.client AS client_6 FROM oauth2_access_token t0 WHERE t0.identifier = ? (parameters: array{"1":"54164b61e53462c58340881ae063659fc0f723d93f94d27e3ac80a11144c3dcaa38399e5585ffae0"}, types: array{"1":0}) {"sql":"SELECT t0.identifier AS identifier_1, t0.expiry AS expiry_2, t0.user_identifier AS user_identifier_3, t0.scopes AS scopes_4, t0.revoked AS revoked_5, t0.client AS client_6 FROM oauth2_access_token t0 WHERE t0.identifier = ?","params":{"1":"54164b61e53462c58340881ae063659fc0f723d93f94d27e3ac80a11144c3dcaa38399e5585ffae0"},"types":{"1":{"Doctrine\\DBAL\\ParameterType":0}}} []
[2026-07-23 10:53:55.278] doctrine.DEBUG: Executing statement: SELECT t0.name AS name_1, t0.secret AS secret_2, t0.redirect_uris AS redirect_uris_3, t0.grants AS grants_4, t0.scopes AS scopes_5, t0.active AS active_6, t0.allow_plain_text_pkce AS allow_plain_text_pkce_7, t0.identifier AS identifier_8 FROM oauth2_client t0 WHERE t0.identifier = ? LIMIT 1 (parameters: array{"1":"xxx"}, types: array{"1":0}) {"sql":"SELECT t0.name AS name_1, t0.secret AS secret_2, t0.redirect_uris AS redirect_uris_3, t0.grants AS grants_4, t0.scopes AS scopes_5, t0.active AS active_6, t0.allow_plain_text_pkce AS allow_plain_text_pkce_7, t0.identifier AS identifier_8 FROM oauth2_client t0 WHERE t0.identifier = ? LIMIT 1","params":{"1":"xxx"},"types":{"1":{"Doctrine\\DBAL\\ParameterType":0}}} []

v1.2.1

[2026-07-23 10:44:31.537] request.INFO: Matched route "api_oauth2_token". {"route":"api_oauth2_token","route_parameters":{"_route":"api_oauth2_token","_controller":"league.oauth2_server.controller.token::indexAction"},"request_uri":"http://localhost/api/oauth-token","method":"POST"} []
[2026-07-23 10:44:31.558] doctrine.DEBUG: Executing statement: SELECT t0.name AS name_1, t0.secret AS secret_2, t0.redirect_uris AS redirect_uris_3, t0.grants AS grants_4, t0.scopes AS scopes_5, t0.active AS active_6, t0.allow_plain_text_pkce AS allow_plain_text_pkce_7, t0.identifier AS identifier_8 FROM oauth2_client t0 WHERE t0.identifier = ? LIMIT 1 (parameters: array{"1":"xxx"}, types: array{"1":0}) {"sql":"SELECT t0.name AS name_1, t0.secret AS secret_2, t0.redirect_uris AS redirect_uris_3, t0.grants AS grants_4, t0.scopes AS scopes_5, t0.active AS active_6, t0.allow_plain_text_pkce AS allow_plain_text_pkce_7, t0.identifier AS identifier_8 FROM oauth2_client t0 WHERE t0.identifier = ? LIMIT 1","params":{"1":"xxx"},"types":{"1":{"Doctrine\\DBAL\\ParameterType":0}}} []
[2026-07-23 10:44:31.559] doctrine.DEBUG: Executing statement: SELECT t0.name AS name_1, t0.secret AS secret_2, t0.redirect_uris AS redirect_uris_3, t0.grants AS grants_4, t0.scopes AS scopes_5, t0.active AS active_6, t0.allow_plain_text_pkce AS allow_plain_text_pkce_7, t0.identifier AS identifier_8 FROM oauth2_client t0 WHERE t0.identifier = ? LIMIT 1 (parameters: array{"1":"xxx"}, types: array{"1":0}) {"sql":"SELECT t0.name AS name_1, t0.secret AS secret_2, t0.redirect_uris AS redirect_uris_3, t0.grants AS grants_4, t0.scopes AS scopes_5, t0.active AS active_6, t0.allow_plain_text_pkce AS allow_plain_text_pkce_7, t0.identifier AS identifier_8 FROM oauth2_client t0 WHERE t0.identifier = ? LIMIT 1","params":{"1":"xxx"},"types":{"1":{"Doctrine\\DBAL\\ParameterType":0}}} []
[2026-07-23 10:44:31.854] doctrine.DEBUG: Executing statement: SELECT t0.name AS name_1, t0.secret AS secret_2, t0.redirect_uris AS redirect_uris_3, t0.grants AS grants_4, t0.scopes AS scopes_5, t0.active AS active_6, t0.allow_plain_text_pkce AS allow_plain_text_pkce_7, t0.identifier AS identifier_8 FROM oauth2_client t0 WHERE t0.identifier = ? LIMIT 1 (parameters: array{"1":"xxx"}, types: array{"1":0}) {"sql":"SELECT t0.name AS name_1, t0.secret AS secret_2, t0.redirect_uris AS redirect_uris_3, t0.grants AS grants_4, t0.scopes AS scopes_5, t0.active AS active_6, t0.allow_plain_text_pkce AS allow_plain_text_pkce_7, t0.identifier AS identifier_8 FROM oauth2_client t0 WHERE t0.identifier = ? LIMIT 1","params":{"1":"xxx"},"types":{"1":{"Doctrine\\DBAL\\ParameterType":0}}} []
[2026-07-23 10:44:31.855] doctrine.DEBUG: Executing statement: SELECT t0.identifier AS identifier_1, t0.expiry AS expiry_2, t0.user_identifier AS user_identifier_3, t0.scopes AS scopes_4, t0.revoked AS revoked_5, t0.client AS client_6 FROM oauth2_access_token t0 WHERE t0.identifier = ? (parameters: array{"1":"935fbd7465a4e4954c31a5796768e108f4f6e10c2b504cba322070c349a17701770456446e2fdac1"}, types: array{"1":0}) {"sql":"SELECT t0.identifier AS identifier_1, t0.expiry AS expiry_2, t0.user_identifier AS user_identifier_3, t0.scopes AS scopes_4, t0.revoked AS revoked_5, t0.client AS client_6 FROM oauth2_access_token t0 WHERE t0.identifier = ?","params":{"1":"935fbd7465a4e4954c31a5796768e108f4f6e10c2b504cba322070c349a17701770456446e2fdac1"},"types":{"1":{"Doctrine\\DBAL\\ParameterType":0}}} []
[2026-07-23 10:44:31.856] doctrine.DEBUG: Executing statement: SELECT t0.name AS name_1, t0.secret AS secret_2, t0.redirect_uris AS redirect_uris_3, t0.grants AS grants_4, t0.scopes AS scopes_5, t0.active AS active_6, t0.allow_plain_text_pkce AS allow_plain_text_pkce_7, t0.identifier AS identifier_8 FROM oauth2_client t0 WHERE t0.identifier = ? LIMIT 1 (parameters: array{"1":"xxx"}, types: array{"1":0}) {"sql":"SELECT t0.name AS name_1, t0.secret AS secret_2, t0.redirect_uris AS redirect_uris_3, t0.grants AS grants_4, t0.scopes AS scopes_5, t0.active AS active_6, t0.allow_plain_text_pkce AS allow_plain_text_pkce_7, t0.identifier AS identifier_8 FROM oauth2_client t0 WHERE t0.identifier = ? LIMIT 1","params":{"1":"xxx"},"types":{"1":{"Doctrine\\DBAL\\ParameterType":0}}} []

(notice the timestamps)

DB structure didn't change so it cannot be related to those queries. Not sure what's happening in OAuth code, any ideas where to look or what could be the culprit?

[Payn]

So it looks like the issue is the newly added client secret hashing.
Can be fixed with reducing the hashing cost in tests:

# config/services_test.yaml

services:
    league.oauth2_server.password_hasher:
        class: Symfony\Component\PasswordHasher\Hasher\NativePasswordHasher
        arguments:
            $cost: 4

[chalasr]

Thanks! We're gonna document this workaround and provide it out of the box by patching the recipe. Also let's try to optimize that logic. Keeping this open until at least the 2 first actions are done. PR welcome anyone 🙏