youngkermit8-coder opened a new issue, #1513: URL: https://github.com/apache/rocketmq-dashboard/issues/1513
## Bug Report ### Environment - Branch: `rocketmq-studio` - JDK: 21 ### Description `AuthInterceptor.isLoginRequired()` catches every exception from `SettingsRepository.loadGeneralSettings()` and returns `false`. When the static `studio.auth.login-required` property is false and the runtime policy lookup temporarily fails, protected API requests are therefore allowed without authentication. The database-backed toggle can require login during normal operation, but a transient database error silently changes the effective policy from "login required" to "login disabled". ### Reproduction 1. Configure the runtime general setting with `requireLogin=true` while leaving the static property at its default. 2. Make `SettingsRepository.loadGeneralSettings()` throw a transient persistence exception. 3. Send an unauthenticated request to a protected endpoint such as `GET /api/clusters`. 4. `AuthInterceptor.preHandle()` returns `true` because the policy lookup exception is treated as `loginRequired=false`. ### Expected behavior Authentication policy lookup failures should fail closed: protected endpoints must require authentication until the policy can be read again. Existing public paths, health checks, CORS preflights, and the login endpoint should remain available through their current exemptions. ### Proposed scope - Treat runtime login-policy read failures as `loginRequired=true`. - Add a regression test proving an unauthenticated protected request receives HTTP 401 when the settings repository fails. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
