# High-Throughput, Low-Latency Authorization Handling **URL:** \ **Category:** Questions / Help\ **Tags:** cowboy, erlang, code\ **Created:** [March 11, 2026, 5:20pm UTC](https://erlangforums.com/t/high-throughput-low-latency-authorization-handling/5486 "2026-03-11T17:20:26Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![PCOM](https://erlangforums.com/letter_avatar_proxy/v4/letter/p/ee59a6/32.png) [@PCOM](https://erlangforums.com/u/PCOM)\ **Post date:** [March 11, 2026, 5:20pm UTC](https://erlangforums.com/t/high-throughput-low-latency-authorization-handling/5486/1 "2026-03-11T17:20:26Z")
Hi all! Simple question, really just want to get a feel for what everyone else is doing here. When it comes to, well, exactly what the title says, are most of you guys just isolating your distributed nodes within a vpc and then having an application load balancer/network load balancer sit in top to validate authentication? I don’t imagine anyone is running http requests WITH bearer auth directly to a cowboy server at like 10-20k sustained requests/second, but I could be wrong? Again, just curious and hoping to potentially spark some constructive conversation here. Thank you! ---
**Author:** ![mmzeeman](https://erlangforums.com/user_avatar/erlangforums.com/mmzeeman/32/467_2.png) [@mmzeeman](https://erlangforums.com/u/mmzeeman)\ **Post date:** [March 12, 2026, 7:50am UTC](https://erlangforums.com/t/high-throughput-low-latency-authorization-handling/5486/2 "2026-03-12T07:50:14Z")
We have been using termit for bearer tokens in Zotonic for a long time. Zotonic runs on cowboy + cowmachine, which is a web machine like implementation for cowboy. Zotonic ran on mochiweb + an highly optimized webmachine version. Some people run zotonic behind a proxy, which terminates the TLS streams, the tokens are still decoded in erlang though. Other people want to keep things simple and directly expose erlang to the internet. Personally I have done some measurements on using a proxy vs not using one. Using a proxy usually doubles your response times. Personally I have ran Zotonic servers with easily handled 200k concurrent open tcp connections. That was with mochiweb. Before you hit that, you have probably ran into some host os configuration issues. The bearer token validation itself is not a real performance concern. I guess there just is an enormous gap in time needed to do crypto versus doing io. The termit module itself is up for some modernization though. It uses md5 for key derivation. Doesn’t have mac and encryption key separation, uses hmac sha1 for signing and aes cfb. The algorithms are not broken, but all a bit dated. ---
**Author:** ![mmzeeman](https://erlangforums.com/user_avatar/erlangforums.com/mmzeeman/32/467_2.png) [@mmzeeman](https://erlangforums.com/u/mmzeeman)\ **Post date:** [March 12, 2026, 9:57am UTC](https://erlangforums.com/t/high-throughput-low-latency-authorization-handling/5486/3 "2026-03-12T09:57:34Z")
You can, of course, also speed up things by caching the token verification result and invalidate it when it expires. ---
**Author:** ![PCOM](https://erlangforums.com/letter_avatar_proxy/v4/letter/p/ee59a6/32.png) [@PCOM](https://erlangforums.com/u/PCOM)\ **Post date:** [March 12, 2026, 12:47pm UTC](https://erlangforums.com/t/high-throughput-low-latency-authorization-handling/5486/4 "2026-03-12T12:47:11Z")
Interesting! Checking both of those things out, and surprised this thread didn’t get more attention, it seemed pretty relevant for every day jobs, at least to me ---
**Author:** ![mmzeeman](https://erlangforums.com/user_avatar/erlangforums.com/mmzeeman/32/467_2.png) [@mmzeeman](https://erlangforums.com/u/mmzeeman)\ **Post date:** [March 12, 2026, 1:57pm UTC](https://erlangforums.com/t/high-throughput-low-latency-authorization-handling/5486/5 "2026-03-12T13:57:42Z")
FYI @mworrell added token validation caching to Zotonic today. We are looking into future proofing the termit module. Some things needs to change there. Everything is safe, but some things will be flagged when the code is reviewed. ---
**Author:** ![mmzeeman](https://erlangforums.com/user_avatar/erlangforums.com/mmzeeman/32/467_2.png) [@mmzeeman](https://erlangforums.com/u/mmzeeman)\ **Post date:** [March 12, 2026, 2:03pm UTC](https://erlangforums.com/t/high-throughput-low-latency-authorization-handling/5486/6 "2026-03-12T14:03:35Z")
Your post triggered us to review our current situation. 😀 ---
**Author:** ![benoitc](https://erlangforums.com/user_avatar/erlangforums.com/benoitc/32/211_2.png) [@benoitc](https://erlangforums.com/u/benoitc)\ **Post date:** [March 12, 2026, 3:40pm UTC](https://erlangforums.com/t/high-throughput-low-latency-authorization-handling/5486/7 "2026-03-12T15:40:20Z")
More than the request number, it’s more about how many unique clients y that connect concurrently. Are you talking about 10/20K clients?