Benchmarks comparing rs/cors and jub0bs/cors
September 4, 2026 · View on GitHub
This repo contains benchmarks (run with Go v1.27.1) that compare the performance of two CORS middleware libraries:
- the more popular rs/cors (v1.11.1), and
- the more user-friendly jub0bs/cors (v1.1.1).
Running the benchmarks
Run the following commands in your shell (preferably on an idle machine):
git clone https://github.com/jub0bs/cors-benchmarks
cd cors-benchmarks
go test -run ^$ -bench . -count 10 > bench.out
benchstat -col "/mw@(rs-cors jub0bs-cors)" bench.out && rm bench.out
Results
goos: darwin
goarch: arm64
pkg: github.com/jub0bs/cors-benchmarks
cpu: Apple M4
│ rs-cors │ jub0bs-cors │
│ sec/op │ sec/op vs base │
CORS/n=one/r=a/o=y-10 544.2n ± 1% 567.2n ± 0% +4.24% (p=0.000 n=10)
CORS/n=one/r=a/o=n-10 548.4n ± 0% 543.0n ± 0% -0.97% (p=0.000 n=10)
CORS/n=multiple/r=a/o=y-10 552.3n ± 0% 572.0n ± 1% +3.57% (p=0.000 n=10)
CORS/n=multiple/r=a/o=n-10 558.5n ± 0% 553.7n ± 0% -0.86% (p=0.000 n=10)
CORS/n=two/r=a/o=y-10 606.8n ± 1% 577.8n ± 0% -4.80% (p=0.000 n=10)
CORS/n=two/r=a/o=n-10 606.7n ± 0% 553.1n ± 0% -8.83% (p=0.000 n=10)
CORS/n=many/r=a/o=y-10 1075.5n ± 1% 587.1n ± 0% -45.42% (p=0.000 n=10)
CORS/n=many/r=a/o=n-10 664.7n ± 0% 545.9n ± 0% -17.88% (p=0.000 n=10)
CORS/n=all/r=a/o=y-10 550.5n ± 0% 531.5n ± 0% -3.44% (p=0.000 n=10)
CORS/n=one/r=p/o=y-10 467.1n ± 1% 407.3n ± 0% -12.79% (p=0.000 n=10)
CORS/n=one/r=p/o=n-10 388.9n ± 0% 104.2n ± 0% -73.19% (p=0.000 n=10)
CORS/n=multiple/r=p/o=y-10 470.3n ± 0% 410.0n ± 0% -12.82% (p=0.000 n=10)
CORS/n=multiple/r=p/o=n-10 399.5n ± 0% 109.5n ± 1% -72.57% (p=0.000 n=10)
CORS/n=two/r=p/o=y-10 522.4n ± 0% 414.6n ± 0% -20.65% (p=0.000 n=10)
CORS/n=two/r=p/o=n-10 447.3n ± 1% 108.3n ± 0% -75.79% (p=0.000 n=10)
CORS/n=many/r=p/o=y-10 964.0n ± 1% 430.9n ± 0% -55.30% (p=0.000 n=10)
CORS/n=many/r=p/o=n-10 513.1n ± 0% 104.0n ± 0% -79.72% (p=0.000 n=10)
CORS/n=all/r=p/o=y-10 460.5n ± 1% 406.4n ± 1% -11.76% (p=0.000 n=10)
CORS/n=all/r=p/o=y/m=evil_acrh-10 464.4n ± 0% 124.4n ± 0% -73.21% (p=0.000 n=10)
geomean 548.9n 336.5n -38.70%
│ rs-cors │ jub0bs-cors │
│ B/op │ B/op vs base │
CORS/n=one/r=a/o=y-10 1.047Ki ± 0% 1.047Ki ± 0% ~ (p=1.000 n=10) ¹
CORS/n=one/r=a/o=n-10 1.047Ki ± 0% 1.031Ki ± 0% -1.49% (p=0.000 n=10)
CORS/n=multiple/r=a/o=y-10 1.047Ki ± 0% 1.047Ki ± 0% ~ (p=1.000 n=10) ¹
CORS/n=multiple/r=a/o=n-10 1.047Ki ± 0% 1.031Ki ± 0% -1.49% (p=0.000 n=10)
CORS/n=two/r=a/o=y-10 1.047Ki ± 0% 1.047Ki ± 0% ~ (p=1.000 n=10) ¹
CORS/n=two/r=a/o=n-10 1.047Ki ± 0% 1.031Ki ± 0% -1.49% (p=0.000 n=10)
CORS/n=many/r=a/o=y-10 1.047Ki ± 0% 1.047Ki ± 0% ~ (p=1.000 n=10) ¹
CORS/n=many/r=a/o=n-10 1.047Ki ± 0% 1.031Ki ± 0% -1.49% (p=0.000 n=10)
CORS/n=all/r=a/o=y-10 1.047Ki ± 0% 1.031Ki ± 0% -1.49% (p=0.000 n=10)
CORS/n=one/r=p/o=y-10 976.0 ± 0% 944.0 ± 0% -3.28% (p=0.000 n=10)
CORS/n=one/r=p/o=n-10 960.0 ± 0% 208.0 ± 0% -78.33% (p=0.000 n=10)
CORS/n=multiple/r=p/o=y-10 976.0 ± 0% 944.0 ± 0% -3.28% (p=0.000 n=10)
CORS/n=multiple/r=p/o=n-10 960.0 ± 0% 208.0 ± 0% -78.33% (p=0.000 n=10)
CORS/n=two/r=p/o=y-10 976.0 ± 0% 944.0 ± 0% -3.28% (p=0.000 n=10)
CORS/n=two/r=p/o=n-10 960.0 ± 0% 208.0 ± 0% -78.33% (p=0.000 n=10)
CORS/n=many/r=p/o=y-10 976.0 ± 0% 944.0 ± 0% -3.28% (p=0.000 n=10)
CORS/n=many/r=p/o=n-10 960.0 ± 0% 208.0 ± 0% -78.33% (p=0.000 n=10)
CORS/n=all/r=p/o=y-10 976.0 ± 0% 960.0 ± 0% -1.64% (p=0.000 n=10)
CORS/n=all/r=p/o=y/m=evil_acrh-10 968.0 ± 0% 224.0 ± 0% -76.86% (p=0.000 n=10)
geomean 1016.4 673.9 -33.69%
¹ all samples are equal
│ rs-cors │ jub0bs-cors │
│ allocs/op │ allocs/op vs base │
CORS/n=one/r=a/o=y-10 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
CORS/n=one/r=a/o=n-10 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
CORS/n=multiple/r=a/o=y-10 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
CORS/n=multiple/r=a/o=n-10 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
CORS/n=two/r=a/o=y-10 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
CORS/n=two/r=a/o=n-10 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
CORS/n=many/r=a/o=y-10 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
CORS/n=many/r=a/o=n-10 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
CORS/n=all/r=a/o=y-10 12.00 ± 0% 11.00 ± 0% -8.33% (p=0.000 n=10)
CORS/n=one/r=p/o=y-10 8.000 ± 0% 7.000 ± 0% -12.50% (p=0.000 n=10)
CORS/n=one/r=p/o=n-10 9.000 ± 0% 4.000 ± 0% -55.56% (p=0.000 n=10)
CORS/n=multiple/r=p/o=y-10 8.000 ± 0% 7.000 ± 0% -12.50% (p=0.000 n=10)
CORS/n=multiple/r=p/o=n-10 9.000 ± 0% 4.000 ± 0% -55.56% (p=0.000 n=10)
CORS/n=two/r=p/o=y-10 8.000 ± 0% 7.000 ± 0% -12.50% (p=0.000 n=10)
CORS/n=two/r=p/o=n-10 9.000 ± 0% 4.000 ± 0% -55.56% (p=0.000 n=10)
CORS/n=many/r=p/o=y-10 8.000 ± 0% 7.000 ± 0% -12.50% (p=0.000 n=10)
CORS/n=many/r=p/o=n-10 9.000 ± 0% 4.000 ± 0% -55.56% (p=0.000 n=10)
CORS/n=all/r=p/o=y-10 8.000 ± 0% 8.000 ± 0% ~ (p=1.000 n=10) ¹
CORS/n=all/r=p/o=y/m=evil_acrh-10 9.000 ± 0% 5.000 ± 0% -44.44% (p=0.000 n=10)
geomean 9.999 7.626 -23.74%
¹ all samples are equal
Nomenclature:
nindicates the number of allowed origins:one|two|multiple|many|allrindicates the type of request (actual or preflight):a|poindicates whether the request's origin is allowed:y|nmindicates a case involving a malicious request
For more details about the benchmark labeled m=evil_acrh,
see https://github.com/rs/cors/issues/170.