lizhimins commented on PR #662: URL: https://github.com/apache/rocketmq-dashboard/pull/662#issuecomment-5140752553
Closing: the studio backend has no CSRF infrastructure (no CookieCsrfTokenRepository, no /csrf-token endpoint — the fetched path /rocketmq-dashboard/csrf-token belongs to the legacy dashboard and would 404 here). Authentication uses a Bearer token from localStorage attached via header, which is not subject to cookie-based CSRF, so this interceptor would only add a failing pre-flight fetch to every first mutating request. If CSRF protection is introduced server-side later, a matching frontend PR would be welcome. Thanks! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
