ai-yang opened a new issue, #716: URL: https://github.com/apache/rocketmq-dashboard/issues/716
## Affected branch `rocketmq-studio` at `bbf1b7e0cf25a5065ba049b5450cc8155569f710` ## Description The shared Axios response interceptor treats every HTTP 401 as an expired protected session: it clears all local authentication keys and assigns `window.location.href = '/'`. That behavior is correct for protected business APIs, but `/auth/login` and `/auth/status` are intentionally public authentication endpoints. In particular, invalid login credentials normally produce 401. The global interceptor clears the session and forces a route change before the login page can own and display that expected error. A public status request that returns 401 is handled the same way. This mixes two different meanings of 401 and makes public authentication requests trigger protected-session recovery behavior. ## Deterministic reproduction 1. Seed the current local authentication keys. 2. Mock `/auth/login` or `/auth/status` to return HTTP 401. 3. Send the request through the shared API client. 4. Inspect the local authentication keys after the rejected request. On the unmodified branch, both public-path cases clear the session. The focused parameterized regression failed 5/5 times without timers or network access. ## Expected behavior - `/auth/login` and `/auth/status` should reject normally so their caller can render the authentication error; they should not invoke the global clear-and-redirect path. - A 401 from a protected business API must continue to clear the session and redirect. ## Proposed fix and validation Classify the exact public auth paths before applying the global 401 recovery behavior. The comparison should also handle URLs that include the configured API base path while avoiding broad `/auth/*` exemptions. With an exact `/auth/login` and `/auth/status` exemption: - the focused public/protected 401 tests pass 20/20 - the full Node 20 suite passes: 63 files / 268 tests - ESLint passes with 0 errors (4 existing Fast Refresh warnings) - the production build passes No API or backend authentication contract changes are required. Related context: merged PR #668 introduced the public status endpoint and route guard, and intentionally did not modify `web/src/api/client.ts`. It does not distinguish public authentication failures inside the shared response interceptor, so this is a small follow-up rather than a duplicate. Closed PR #662 touched the same client file for CSRF but was not merged and did not address this behavior. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
