diff --git a/src/json_filter.cpp b/src/json_filter.cpp
index ee8f34b..992ab87 100644
--- a/src/json_filter.cpp
+++ b/src/json_filter.cpp
@@ -3,23 +3,26 @@
 template <bool check_content_type>
 JsonFilter<check_content_type>::JsonFilter() {}
 
-__attribute__((always_inline)) inline bool Contains(std::string_view str, const std::string &val) { return str.find(val) != std::string::npos; }
+__attribute__((always_inline)) inline bool Contains(std::string_view str, const std::string &val)
+{
+    return str.find(val) != std::string::npos;
+}
 
 template <bool check_content_type>
 void JsonFilter<check_content_type>::doFilter(const HttpRequestPtr &req,
                                               FilterCallback &&fcb,
                                               FilterChainCallback &&fccb)
 {
-    std::string_view accept_header = req->getHeader("Accept");
+    static thread_local std::string_view accept_header = req->getHeader("Accept");
     if constexpr (check_content_type)
     {
-        std::string_view content_type = req->getHeader("content-type");
+        static thread_local std::string_view content_type = req->getHeader("content-type");
         if (content_type == "application/json" && (Contains(accept_header, "*/*") || Contains(accept_header, "application/json")))
         {
             fccb();
             return;
         }
-        const auto &resp = HttpResponse::newCustomHttpResponse(BankResponse(k406NotAcceptable, "\"Client must Accept and have content-type of JSON\""));
+        static thread_local const auto &resp = HttpResponse::newCustomHttpResponse(BankResponse(k406NotAcceptable, "\"Client must Accept and have content-type of JSON\""));
         fcb(resp);
     }
     else
@@ -29,7 +32,7 @@ void JsonFilter<check_content_type>::doFilter(const HttpRequestPtr &req,
             fccb();
             return;
         }
-        const auto &resp = HttpResponse::newCustomHttpResponse(BankResponse(k406NotAcceptable, "\"Client must Accept JSON\""));
+        static thread_local const auto &resp = HttpResponse::newCustomHttpResponse(BankResponse(k406NotAcceptable, "\"Client must Accept JSON\""));
         fcb(resp);
     }
 }
diff --git a/src/user_filter.cpp b/src/user_filter.cpp
index d4d1bc5..b7849a4 100644
--- a/src/user_filter.cpp
+++ b/src/user_filter.cpp
@@ -8,22 +8,22 @@ void UserFilter<set_body_flag, require_admin>::doFilter(const HttpRequestPtr &re
                                                         FilterCallback &&fcb,
                                                         FilterChainCallback &&fccb)
 {
-    std::string_view auth_header = req->getHeader("Authorization");
+    static thread_local std::string_view auth_header = req->getHeader("Authorization");
     if (auth_header.size() > 6)
     {
         if (auth_header.substr(0, 6) == "Basic ")
         {
-            std::string_view base64_input = auth_header.substr(6);
-            char base64_result[(base64_input.size() * 3) / 4]; //only alloc
-            size_t new_sz;
-            base64_decode(base64_input.data(), base64_input.size(), base64_result, &new_sz, 0);
+            static thread_local std::string_view base64_input = auth_header.substr(6);
+            static thread_local std::array<char, 511> base64_result; //255 username + ':' + 255 password
+            static thread_local size_t new_sz;
+            base64_decode(base64_input.data(), base64_input.size(), base64_result.begin(), &new_sz, 0);
 
-            std::string_view results_view(base64_result, new_sz);
-            std::size_t middle = results_view.find(':');
+            static thread_local std::string_view results_view(base64_result.begin(), new_sz);
+            static thread_local std::size_t middle = results_view.find(':');
             if (middle != std::string::npos)
             {
                 base64_result[middle] = '\0';
-                const std::string &username(results_view.substr(0, middle).data());
+                static thread_local const std::string &username(results_view.substr(0, middle).data());
                 if constexpr (require_admin)
                 {
                     if (bank.AdminVerifyAccount(username))
@@ -52,7 +52,7 @@ void UserFilter<set_body_flag, require_admin>::doFilter(const HttpRequestPtr &re
             }
         }
     }
-    const auto &resp = HttpResponse::newCustomHttpResponse(BankResponse(k401Unauthorized, "\"Invalid Credentials\""));
+    static thread_local const auto &resp = HttpResponse::newCustomHttpResponse(BankResponse(k401Unauthorized, "\"Invalid Credentials\""));
     fcb(resp);
 }