You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "youngkermit8-coder (via GitHub)" <gi...@apache.org> on 2026/08/11 08:44:46 UTC

[PR] [ISSUE #1692] Disable caching for credential reveal responses [rocketmq-dashboard]

youngkermit8-coder opened a new pull request, #1695:
URL: https://github.com/apache/rocketmq-dashboard/pull/1695

   ## Summary
   
   - return `Cache-Control: no-store` from both credential reveal endpoints
   - cover ACL user credentials and cloud provider credentials with controller tests
   
   ## Why
   
   These authenticated GET endpoints return plaintext access keys and secret keys. The ordinary `Result` responses did not include a cache directive, so browsers or intermediary caches could retain sensitive credential responses.
   
   Using `ResponseEntity` with `CacheControl.noStore()` keeps the JSON response shape unchanged while preventing storage of the revealed secrets.
   
   ## Validation
   
   - baseline reproduction on `rocketmq-studio` (`65d1c32`): 2 new assertions failed because `Cache-Control` was absent
   - `mvn -Dtest=AclControllerTest,CloudCredentialControllerTest test` - 22 tests passed
   - related auth, ACL, and cloud credential regression suite - 142 tests passed
   - Checkstyle - 0 violations
   - `mvn -DskipTests package` - passed
   
   Closes #1692
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [ISSUE #1692] Disable caching for credential reveal responses [rocketmq-dashboard]

Posted by "lizhimins (via GitHub)" <gi...@apache.org>.
lizhimins merged PR #1695:
URL: https://github.com/apache/rocketmq-dashboard/pull/1695


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org