Benchmarks comparing rs/cors and jub0bs/cors
June 12, 2026 · View on GitHub
This repo contains benchmarks (run with Go v1.26.4) that compare the performance of two CORS middleware libraries:
- the more popular rs/cors (v1.11.1), and
- the more user-friendly jub0bs/cors (v1.0.4).
Running the benchmarks
Run the following commands in your shell (preferably on an idle machine):
git clone https://github.com/jub0bs/cors-benchmarks
cd cors-benchmarks
go test -run ^$ -bench . -count 10 > bench.out
benchstat -col "/mw@(rs-cors jub0bs-cors)" bench.out && rm bench.out
Results
goos: darwin
goarch: arm64
pkg: github.com/jub0bs/cors-benchmarks
cpu: Apple M4
│ rs-cors │ jub0bs-cors │
│ sec/op │ sec/op vs base │
CORS/n=one/r=a/o=y-10 526.7n ± 1% 544.7n ± 1% +3.41% (p=0.000 n=10)
CORS/n=one/r=a/o=n-10 521.6n ± 2% 517.5n ± 1% ~ (p=0.052 n=10)
CORS/n=multiple/r=a/o=y-10 528.8n ± 2% 550.5n ± 1% +4.10% (p=0.001 n=10)
CORS/n=multiple/r=a/o=n-10 537.6n ± 1% 527.9n ± 3% -1.80% (p=0.022 n=10)
CORS/n=two/r=a/o=y-10 598.1n ± 1% 553.8n ± 2% -7.40% (p=0.000 n=10)
CORS/n=two/r=a/o=n-10 600.5n ± 1% 526.8n ± 1% -12.27% (p=0.000 n=10)
CORS/n=many/r=a/o=y-10 1476.5n ± 1% 585.3n ± 1% -60.36% (p=0.000 n=10)
CORS/n=many/r=a/o=n-10 682.5n ± 1% 534.3n ± 1% -21.71% (p=0.000 n=10)
CORS/n=all/r=a/o=y-10 525.4n ± 2% 518.5n ± 1% ~ (p=0.211 n=10)
CORS/n=one/r=p/o=y-10 442.6n ± 2% 416.1n ± 1% -5.99% (p=0.000 n=10)
CORS/n=one/r=p/o=n-10 395.8n ± 1% 102.6n ± 2% -74.08% (p=0.000 n=10)
CORS/n=multiple/r=p/o=y-10 446.4n ± 1% 417.7n ± 1% -6.44% (p=0.002 n=10)
CORS/n=multiple/r=p/o=n-10 402.9n ± 0% 112.6n ± 2% -72.07% (p=0.000 n=10)
CORS/n=two/r=p/o=y-10 521.7n ± 1% 423.6n ± 1% -18.80% (p=0.000 n=10)
CORS/n=two/r=p/o=n-10 470.0n ± 1% 107.9n ± 1% -77.04% (p=0.000 n=10)
CORS/n=many/r=p/o=y-10 1293.0n ± 1% 452.9n ± 1% -64.97% (p=0.000 n=10)
CORS/n=many/r=p/o=n-10 540.2n ± 1% 108.2n ± 1% -79.96% (p=0.000 n=10)
CORS/n=all/r=p/o=y-10 437.8n ± 2% 435.1n ± 3% ~ (p=0.481 n=10)
CORS/n=all/r=p/o=y/m=evil_acrh-10 470.8n ± 2% 154.0n ± 1% -67.29% (p=0.000 n=10)
geomean 560.2n 338.7n -39.53%
│ rs-cors │ jub0bs-cors │
│ B/op │ B/op vs base │
CORS/n=one/r=a/o=y-10 1.047Ki ± 0% 1.047Ki ± 0% ~ (p=1.000 n=10) ¹
CORS/n=one/r=a/o=n-10 1.047Ki ± 0% 1.031Ki ± 0% -1.49% (p=0.000 n=10)
CORS/n=multiple/r=a/o=y-10 1.047Ki ± 0% 1.047Ki ± 0% ~ (p=1.000 n=10) ¹
CORS/n=multiple/r=a/o=n-10 1.047Ki ± 0% 1.031Ki ± 0% -1.49% (p=0.000 n=10)
CORS/n=two/r=a/o=y-10 1.047Ki ± 0% 1.047Ki ± 0% ~ (p=1.000 n=10) ¹
CORS/n=two/r=a/o=n-10 1.047Ki ± 0% 1.031Ki ± 0% -1.49% (p=0.000 n=10)
CORS/n=many/r=a/o=y-10 1.047Ki ± 0% 1.047Ki ± 0% ~ (p=1.000 n=10) ¹
CORS/n=many/r=a/o=n-10 1.047Ki ± 0% 1.031Ki ± 0% -1.49% (p=0.000 n=10)
CORS/n=all/r=a/o=y-10 1.047Ki ± 0% 1.031Ki ± 0% -1.49% (p=0.000 n=10)
CORS/n=one/r=p/o=y-10 976.0 ± 0% 944.0 ± 0% -3.28% (p=0.000 n=10)
CORS/n=one/r=p/o=n-10 960.0 ± 0% 208.0 ± 0% -78.33% (p=0.000 n=10)
CORS/n=multiple/r=p/o=y-10 976.0 ± 0% 944.0 ± 0% -3.28% (p=0.000 n=10)
CORS/n=multiple/r=p/o=n-10 960.0 ± 0% 208.0 ± 0% -78.33% (p=0.000 n=10)
CORS/n=two/r=p/o=y-10 976.0 ± 0% 944.0 ± 0% -3.28% (p=0.000 n=10)
CORS/n=two/r=p/o=n-10 960.0 ± 0% 208.0 ± 0% -78.33% (p=0.000 n=10)
CORS/n=many/r=p/o=y-10 976.0 ± 0% 944.0 ± 0% -3.28% (p=0.000 n=10)
CORS/n=many/r=p/o=n-10 960.0 ± 0% 208.0 ± 0% -78.33% (p=0.000 n=10)
CORS/n=all/r=p/o=y-10 976.0 ± 0% 960.0 ± 0% -1.64% (p=0.000 n=10)
CORS/n=all/r=p/o=y/m=evil_acrh-10 968.0 ± 0% 224.0 ± 0% -76.86% (p=0.000 n=10)
geomean 1016.4 673.9 -33.69%
¹ all samples are equal
│ rs-cors │ jub0bs-cors │
│ allocs/op │ allocs/op vs base │
CORS/n=one/r=a/o=y-10 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
CORS/n=one/r=a/o=n-10 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
CORS/n=multiple/r=a/o=y-10 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
CORS/n=multiple/r=a/o=n-10 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
CORS/n=two/r=a/o=y-10 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
CORS/n=two/r=a/o=n-10 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
CORS/n=many/r=a/o=y-10 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
CORS/n=many/r=a/o=n-10 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
CORS/n=all/r=a/o=y-10 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
CORS/n=one/r=p/o=y-10 8.000 ± 0% 7.000 ± 0% -12.50% (p=0.000 n=10)
CORS/n=one/r=p/o=n-10 9.000 ± 0% 4.000 ± 0% -55.56% (p=0.000 n=10)
CORS/n=multiple/r=p/o=y-10 8.000 ± 0% 7.000 ± 0% -12.50% (p=0.000 n=10)
CORS/n=multiple/r=p/o=n-10 9.000 ± 0% 4.000 ± 0% -55.56% (p=0.000 n=10)
CORS/n=two/r=p/o=y-10 8.000 ± 0% 7.000 ± 0% -12.50% (p=0.000 n=10)
CORS/n=two/r=p/o=n-10 9.000 ± 0% 4.000 ± 0% -55.56% (p=0.000 n=10)
CORS/n=many/r=p/o=y-10 8.000 ± 0% 7.000 ± 0% -12.50% (p=0.000 n=10)
CORS/n=many/r=p/o=n-10 9.000 ± 0% 4.000 ± 0% -55.56% (p=0.000 n=10)
CORS/n=all/r=p/o=y-10 8.000 ± 0% 8.000 ± 0% ~ (p=1.000 n=10) ¹
CORS/n=all/r=p/o=y/m=evil_acrh-10 9.000 ± 0% 5.000 ± 0% -44.44% (p=0.000 n=10)
geomean 9.999 7.626 -23.74%
¹ all samples are equal
Nomenclature:
nindicates the number of allowed origins:one|two|multiple|many|allrindicates the type of request (actual or preflight):a|poindicates whether the request's origin is allowed:y|nmindicates a case involving a malicious request
For more details about the benchmark labeled m=evil_acrh,
see https://github.com/rs/cors/issues/170.