yyqdbngt opened a new issue, #1005:
URL: https://github.com/apache/rocketmq-dashboard/issues/1005
## Problem
When `studio.auth.login-required=true`, the backend checks only whether a
bearer
token is authenticated. The `admin` flag stored in each authenticated
session is
never consulted by `AuthInterceptor` or any controller.
As a result, a user configured with `admin: false` can call every mutating
API
directly, including topic/group deletion, ACL user changes, cluster
configuration
updates, NameServer changes, audit cleanup, and Studio settings updates.
## Evidence
At `rocketmq-studio` commit `228ad5298dbbeaa769f1c1de242117c6cfbe4216`:
- `AuthService` stores `LoginVO.UserInfo.admin` in each `AuthSession`.
- `AuthInterceptor` calls only `authService.isAuthenticated(...)`.
- no backend production code reads the authenticated session's admin flag.
- the Ops UI hides write controls for `admin: false`, confirming that these
accounts are intended to be read-only, but direct HTTP requests bypass the
UI.
- `docs/api-spec.md` defines HTTP 403 for requests without permission, but
the
authentication path never emits it.
## Reproduction
1. Enable login and configure a user with `admin: false`.
2. Log in as that user and retain the returned bearer token.
3. Send a mutating request such as `POST /api/ops/updateUseTLS` or
`POST /api/topics/delete` with that token.
4. The request reaches the controller instead of returning HTTP 403.
## Impact
A read-only account can alter or delete RocketMQ resources and Studio
configuration. Hiding controls in the frontend is not an authorization
boundary.
## Expected behavior
- authenticated non-admin sessions may use read-only APIs;
- mutating endpoints require an authenticated admin session and return HTTP
403
before controller execution otherwise;
- login, logout, CORS preflight, and explicitly read-only POST queries
continue to
work for non-admin users;
- authorization defaults to deny for new mutating endpoints;
- integration tests cover reader and admin sessions.
## Proposed fix
Enforce the role centrally in the authentication interceptor. Treat safe HTTP
methods and a small explicit set of read-only POST endpoints as
reader-accessible;
require admin for all other protected requests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
