yx9o opened a new issue, #511: URL: https://github.com/apache/rocketmq-dashboard/issues/511
## Problem `GET /api/settings/general` returns the stored `apiKey` in plaintext, exposing it to the browser whenever General Settings is opened. The current save behavior also cannot clearly distinguish between preserving and clearing an existing key. ## Expected behavior - Never return the stored API Key. - Return only whether an API Key is configured. - Preserve the existing key when the field is empty or omitted. - Replace it when a new key is provided. - Clear it only through an explicit action. ## Proposed fix Make `apiKey` write-only, expose `apiKeyConfigured`, add an explicit `clearApiKey` option, and update the frontend, tests, and API documentation accordingly. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
