You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "youngkermit8-coder (via GitHub)" <gi...@apache.org> on 2026/08/11 08:40:39 UTC
[I] [Studio][Security] Disable caching for credential reveal responses [rocketmq-dashboard]
youngkermit8-coder opened a new issue, #1692:
URL: https://github.com/apache/rocketmq-dashboard/issues/1692
## Security bug
The two administrator-only credential reveal endpoints return plaintext access/secret keys in ordinary GET responses without `Cache-Control: no-store`:
- `GET /api/acl/users/{id}/credentials`
- `GET /api/cloud-credentials/{id}/credentials`
Without an explicit no-store directive, browsers and intermediary caches are permitted to retain these highly sensitive responses. Authentication and authorization restrict who can request them, but they do not prevent a previously authorized response from being written to a cache.
## Reproduction
Focused MockMvc tests on current `rocketmq-studio` call both endpoints and inspect the response headers. Both return HTTP 200 with plaintext credential fields and no `Cache-Control` header.
## Expected behavior
Every response that exposes stored credentials must include `Cache-Control: no-store`, matching the existing treatment of authentication status responses.
## Proposed scope
- return no-store `ResponseEntity` responses from both credential reveal handlers;
- keep response bodies and endpoint URLs backward compatible;
- add controller regressions for both endpoints.
## Duplicate check
Searched open and closed issues and pull requests for credential response caching, `Cache-Control`, `no-store`, browser cache, ACL secrets, and cloud credential reveal. No matching contribution was found.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Security] Disable caching for credential reveal responses [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed issue #1692: [Studio][Security] Disable caching for credential reveal responses
URL: https://github.com/apache/rocketmq-dashboard/issues/1692
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Security] Disable caching for credential reveal responses [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #1692:
URL: https://github.com/apache/rocketmq-dashboard/issues/1692#issuecomment-5723049876
This issue has been automatically closed because there has been no activity for 7 days. If you believe this issue is still relevant, please reopen it with updated information.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Security] Disable caching for credential reveal responses [rocketmq-dashboard]
Posted by "RockteMQ-AI (via GitHub)" <gi...@apache.org>.
RockteMQ-AI commented on issue #1692:
URL: https://github.com/apache/rocketmq-dashboard/issues/1692#issuecomment-5251152326
**Issue Evaluation**
Category: `question` | Status: **Needs Info**
Thank you for reporting this issue. However, automated verification found that the referenced code components do not exist in the current `apache/rocketmq-dashboard` codebase (checked on `main` branch).
The classes, endpoints, and files mentioned in this issue (e.g., Studio-specific controllers, providers, and frontend components) appear to belong to a separate **RocketMQ Studio** project that has not been merged into this repository.
**To help us triage this correctly, please clarify:**
- [ ] Is this issue targeting a different repository (e.g., a separate `rocketmq-studio` repo)?
- [ ] Is the Studio code available on a feature branch that needs to be merged first?
- [ ] Should this issue be filed against a different project?
Once clarified, we will re-classify and proceed with verification.
---
*Automated evaluation by @RockteMQ-AI*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org