You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "coder999o (via GitHub)" <gi...@apache.org> on 2026/10/16 05:09:36 UTC
[PR] fix(auth): invalidate in-flight logins when passwords change [rocketmq-dashboard]
coder999o opened a new pull request, #6849:
URL: https://github.com/apache/rocketmq-dashboard/pull/6849
## What is the purpose of the change
An old-password login can finish password verification, overlap a completed password change, and then insert a session that the password change never revoked. This affects both administrator password resets and self-service password changes.
## Brief changelog
- Keep login password verification and session insertion in one transaction, holding the account's row lock until session issuance completes.
- Reuse the password change's existing user-row update and session revocation ordering: a change either revokes the issued session or finishes before login reads the replacement hash.
- Add real-database concurrency regressions for administrator resets and self-service changes. Coordinate the race through H2 session blocking state, then verify the old bearer is rejected and the replacement password remains usable.
No API or schema changes are required. Concurrent logins for the same account now serialize during password verification and session insertion.
## Verifying this change
Using JDK 22 with the project's Java 21 target:
- `cd server && mvn -o -B -ntp -Dtest=AuthServiceLoginConcurrencyIntegrationTest test` — before the fix, both cases fail because the old-password bearer still authenticates; after the fix, 2 passed.
- `cd server && mvn -o -B -ntp -Dspring.profiles.active=dev '-Dtest=org.apache.rocketmq.studio.auth.**,*ArchitectureTest' test` — 154 authentication tests passed, 0 failures/errors/skips; compilation and the bound Checkstyle check passed.
- `git diff --check` — passed.
Integration verification used H2 in MySQL compatibility mode. A live MySQL deployment and the full repository test suite were not exercised.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(auth): invalidate in-flight logins when passwords change [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed pull request #6849: fix(auth): invalidate in-flight logins when passwords change
URL: https://github.com/apache/rocketmq-dashboard/pull/6849
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(auth): invalidate in-flight logins when passwords change [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #6849:
URL: https://github.com/apache/rocketmq-dashboard/pull/6849#issuecomment-6377400547
This pull request has been automatically closed because there has been no activity for 7 days. If you would like to continue working on this, please reopen the PR with updated changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org