You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@rocketmq.apache.org by "lizhimins (via GitHub)" <gi...@apache.org> on 2026/07/31 08:08:53 UTC

Re: [PR] [Studio] Add CSRF token support for mutating HTTP requests [rocketmq-dashboard]

lizhimins commented on PR #662:
URL: https://github.com/apache/rocketmq-dashboard/pull/662#issuecomment-5140752553

   Closing: the studio backend has no CSRF infrastructure (no CookieCsrfTokenRepository, no /csrf-token endpoint — the fetched path /rocketmq-dashboard/csrf-token belongs to the legacy dashboard and would 404 here). Authentication uses a Bearer token from localStorage attached via header, which is not subject to cookie-based CSRF, so this interceptor would only add a failing pre-flight fetch to every first mutating request. If CSRF protection is introduced server-side later, a matching frontend PR would be welcome. Thanks!


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org