Updated the comparison section to clarify the distinction between ASP.NET Core's built-in rate limiting middleware and the application/domain code level rate limiting module.
Prevents 'Synchronous operations are disallowed' error when rendering
large MVC views (e.g. Account settings page with multiple tabs in
non-English locales).
Normalize Markdown in several docs: corrected code fence markers, fixed mismatched/backticked bold items and list formatting, removed stray dashes and extra whitespace, and standardized image placeholders. Files updated: docs/en/cli/index.md (fix command list/backtick issues and trailing newlines), docs/en/framework/ui/mvc-razor-pages/overall.md (fix code fences, list markers, and image text), and docs/en/framework/ui/react-native/index.md (normalize code fences, image placeholders, CLI notes, ports/examples formatting, and a password escaping fix). These are formatting-only changes to improve consistency and rendering.
- Replace FormattedStringValueExtracter.Extract with LastIndexOf in
PermissionGrantCacheItem and ResourcePermissionGrantCacheItem to
eliminate repeated string tokenization and object allocations on
every cache key parse (~12,000 calls per request with 4000+ permissions)
- Add fast-path in SimpleStateCheckerManager.InternalIsEnabledAsync to
skip DI scope creation when both StateCheckers and GlobalStateCheckers
are empty, avoiding thousands of unnecessary scope allocations
- Optimize PermissionChecker.IsGrantedAsync(string[]) and
ResourcePermissionChecker.IsGrantedAsync(string[], resourceName, resourceKey)
to load all permission definitions once via GetPermissionsAsync /
GetResourcePermissionsAsync instead of N individual GetOrNullAsync calls,
and use batch StateCheckerManager.IsEnabledAsync for state checking
- Optimize AbpApplicationConfigurationAppService.GetAuthConfigAsync to
pre-load all permission names into a HashSet for O(1) lookup instead
of N async GetOrNullAsync calls inside the loop
- Fix GetResourcePermissionsAsync to deduplicate by (ResourceName, Name)
instead of Name only, matching the actual uniqueness constraint of
resource permissions defined in PermissionDefinitionContext
Production impact (customer with 4000+ permissions): 10s+ -> ~682ms