You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@texera.apache.org by "Yicong-Huang (via GitHub)" <gi...@apache.org> on 2026/07/05 08:21:13 UTC

Re: [I] Authorization bypass: @RolesAllowed unenforced on microservices, workflow-compiling-service requires no token at all [texera]

Yicong-Huang commented on issue #4904:
URL: https://github.com/apache/texera/issues/4904#issuecomment-4885370912

   Fixed. Enforcement re-landed in #5199 (all five microservices now register `JwtAuthFilter` + `RolesAllowedDynamicFeature` via the shared `AuthFeatures.register`), file-service was covered in #5198, and #5743 added `RoleAnnotationEnforcer`, which fails service startup if any HTTP resource method lacks `@RolesAllowed`/`@PermitAll`/`@DenyAll` — so annotations can no longer silently be decorative. workflow-compiling-service now requires a JWT as well. Follow-up (out of scope here): notebook-migration-service registers the auth stack but doesn't run `RoleAnnotationEnforcer` yet.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@texera.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org