Not all variants are interchangeable

Escaping quotes and not escaping quotes do not provide the same safety in an HTML attribute. Directly overwriting a public file and atomically replacing it do not provide the same reader behavior during failure. A timing table cannot erase those differences.

ASAMB labels these studies as trade-off measurements. Recommendations begin with required semantics, then use timing to choose among options that satisfy them.

Threat models are not performance flags

Hash algorithms, token sizes and serialization formats must meet the security and trust-boundary requirements of the application. A faster insecure choice is not an optimization.

Continue reading

Full benchmark methodology Browse measured studies