ai-yang opened a new issue, #719: URL: https://github.com/apache/rocketmq-dashboard/issues/719
## Affected branch `rocketmq-studio` at `bbf1b7e0cf25a5065ba049b5450cc8155569f710` ## Description When `studio.auth.login-required=true`, `AuthInterceptor` protects every `/api/**` request before checking whether the request is a CORS preflight. A browser preflight is an `OPTIONS` request with `Origin` and `Access-Control-Request-Method` headers and normally carries no bearer token. The interceptor therefore returns 401 before Spring MVC can produce the configured CORS response. The browser never sends the subsequent authenticated business request, so cross-origin Studio deployments cannot use protected APIs even though `CorsConfig` explicitly allows the origin, method, and headers. ## Deterministic reproduction With login protection enabled, perform this MockMvc request through the real interceptor and CORS configuration: ```text OPTIONS /api/instances Origin: https://studio.example.com Access-Control-Request-Method: GET ``` Expected: HTTP 200 with `Access-Control-Allow-Origin`. Actual on the unmodified branch: HTTP 401 from `AuthInterceptor`. The integration regression failed 5/5 times without a browser, external server, timer, or random scheduling. ## Expected behavior A valid Spring CORS preflight should bypass bearer authentication so the CORS framework can validate and answer it. A normal anonymous request to the protected API must still return 401; this must not become a blanket `OPTIONS` or `/api/**` exemption. ## Proposed fix and validation Use Spring's `CorsUtils.isPreFlightRequest(request)` before the authentication check. This recognizes only a correctly formed preflight (`OPTIONS` plus the required CORS headers), while leaving ordinary protected requests unchanged. Validation with Java 21: - focused preflight/anonymous-request regression: baseline red 5/5, fixed green 20/20 - complete server suite: 488 tests, 0 failures/errors - Maven package: passed - Checkstyle: 0 violations - `git diff --check`: passed Related issue #410 and unmerged PR #414 concern a hard-coded allowed origin on the legacy `master` implementation. They do not involve the `rocketmq-studio` authentication interceptor. Merged PR #668 introduced the current auth route guard/interceptor paths but did not handle CORS preflight. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
