You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "ai-yang (via GitHub)" <gi...@apache.org> on 2026/07/29 07:06:36 UTC

[I] [studio][Bug][Track1] Honor configurable login protection in frontend routing [rocketmq-dashboard]

ai-yang opened a new issue, #664:
URL: https://github.com/apache/rocketmq-dashboard/issues/664

   ## Problem
   
   RocketMQ Studio supports configurable backend API protection through `STUDIO_AUTH_LOGIN_REQUIRED=true` (introduced by #533), but the frontend does not guard management routes.
   
   When login protection is enabled, an unauthenticated user can still open a management route such as `/instance/topic`. The page shell renders, its API calls receive `401 Unauthorized`, and the shared response interceptor clears the local session and reloads `/`. Because `/` is also unguarded, the user is not routed to `/login` and can repeatedly trigger unauthorized requests.
   
   ## Reproduction
   
   1. Start Studio with:
      - `STUDIO_AUTH_LOGIN_REQUIRED=true`
      - a configured admin username and password
   2. Open `/instance/topic` in a private browser session without a token.
   3. Observe that the management layout renders and API requests fail with 401 instead of navigating to the login page.
   
   ## Expected behavior
   
   - The frontend should discover whether login protection is enabled.
   - Protected management routes should render only when login is disabled or the current bearer token is valid.
   - Missing, expired, or revoked sessions should be cleared and redirected to `/login`.
   - Mock-only frontend development should continue to work without a backend.
   - A backend availability failure during the auth check should show a retry state rather than expose protected pages.
   
   ## Proposed atomic scope
   
   - Add a public, non-cacheable `GET /api/auth/status` endpoint returning:
     - `loginRequired`
     - `authenticated`
   - Exempt only that status endpoint from the auth interceptor.
   - Add a frontend route guard around management routes.
   - Keep the existing login/logout and token format unchanged.
   - Add focused backend and frontend regression tests.
   - Keep the change around 10 files and avoid `api/client.ts`, so it does not overlap the active CSRF work in #662.
   
   This is a Track 1 / BASE-01 login-flow correctness fix and a small follow-up to the architecture scope in #427.
   
   ## Validation
   
   - Backend controller and interceptor tests
   - Frontend auth API and route guard tests
   - Full `mvn test`, frontend test/lint/build
   - Manual verification with login protection enabled and disabled
   
   I would like to claim and implement this atomic fix.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [studio][Bug][Track1] Honor configurable login protection in frontend routing [rocketmq-dashboard]

Posted by "lizhimins (via GitHub)" <gi...@apache.org>.
lizhimins commented on issue #664:
URL: https://github.com/apache/rocketmq-dashboard/issues/664#issuecomment-5140925305

   Resolved by #668 (merged into rocketmq-studio as c221dc1).


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [studio][Bug][Track1] Honor configurable login protection in frontend routing [rocketmq-dashboard]

Posted by "lizhimins (via GitHub)" <gi...@apache.org>.
lizhimins closed issue #664: [studio][Bug][Track1] Honor configurable login protection in frontend routing
URL: https://github.com/apache/rocketmq-dashboard/issues/664


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org