[PR] [SECURITY] Enforce server-side session map check in ignore-timeout fallback path [linkis]

["aiceflower (via GitHub)" <gi...@apache.org>]

aiceflower opened a new pull request, #5458:
URL: https://github.com/apache/linkis/pull/5458

   ## Summary
   
   `getLoginUserIgnoreTimeout` previously skipped `isTimeoutOrNot` entirely — any ticket that decrypted cleanly (with the known default key) was accepted even if it was never registered via `setLoginUser`. This was the second half of the auth bypass.
   
   This PR adds `isTimeoutOrNot` for all normal users even in the ignore-timeout path. The only exception is `OTHER_SYSTEM_IGNORE_UM_USER` (internal RPC identity via header).
   
   ## Changes
   
   - `SSOUtils.getLoginUserIgnoreTimeout`: normal users now go through `isTimeoutOrNot` (session map lookup)
   - `OTHER_SYSTEM_IGNORE_UM_USER` remains exempt (internal RPC, not browser-cookie-based)
   
   ## Affected files
   
   - `linkis-commons/linkis-module/.../SSOUtils.scala` (+20/-1)
   
   ## Deployment impact
   
   | Scenario | Impact |
   |---|---|
   | HA mode (Redis session sharing) | No impact |
   | Non-HA (standalone session maps) | Gateway→backend may fail; switch to HA mode recommended |
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@linkis.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@linkis.apache.org
For additional commands, e-mail: dev-help@linkis.apache.org

Re: [PR] [SECURITY] Enforce server-side session map check in ignore-timeout fallback path [linkis]

["casionone (via GitHub)" <gi...@apache.org>]

casionone merged PR #5458:
URL: https://github.com/apache/linkis/pull/5458


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@linkis.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@linkis.apache.org
For additional commands, e-mail: dev-help@linkis.apache.org