Aias00 opened a new issue, #1002: URL: https://github.com/apache/rocketmq-dashboard/issues/1002
## Problem The Settings page persists `sessionTimeout` and `requireLogin`, but runtime authentication uses neither value: - `AuthService` always issues tokens with a hard-coded 24-hour TTL. - `AuthWebConfig` decides whether to register the interceptor from `studio.auth.login-required` only at startup. - Expired sessions are only globally pruned during a subsequent login. As a result, changing the UI settings either has no effect or presents a control that cannot affect runtime behavior. ## Expected behavior - Session timeout should be applied consistently to newly issued sessions, with validated units and a documented fallback. - The login-protection UI must accurately reflect its deployment-controlled behavior; it must not imply a runtime toggle where one is unavailable. - Expired session entries should be reclaimed without relying on an unrelated future login. ## Scope Keep deployment-level `studio.auth.login-required` authoritative. Align the settings UI and persisted configuration contract with that boundary, add targeted authentication tests, and preserve backward-compatible settings reads. ## Track Track 1 / BASE-01 login and permission baseline. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
