After we deployed the OAuth of our product to Azure, we found that we have to spend more than 2000ms (on Azure VM) or 5000ms (on Azure app service) to complete the authentication flow. So these two days I was focus on tuning the performance of authentication. The codes was written by a senior, and after many times of requirement modification or adding, it became a terrible monster. First we read the two specifications of log-in flow, and the codes of 'OAuthAuthorizationServerProvider.GrantResourceOwnerCredentials'. Then we re-organized the log-in flow, and find some obvious performance issues: Hit database more than 15 times. Misuse the method of modifying customer information. It will check some unique fields, such as email, phone, QQ, wechat and nickname. There is even no index created on the column of 'wechat'. Check the customer's device. The codes here query the member devices many times. We should reduce it to one time, or pass the current log-in dev...