youngkermit8-coder opened a new issue, #1678: URL: https://github.com/apache/rocketmq-dashboard/issues/1678
### What happened? Metrics data sources can be configured with `Basic Auth` or `Bearer Token` in Settings. The backend intentionally does not persist these secrets and `POST /api/metrics/query/datasource` accepts them per request. However, Metrics Explorer immediately queries a selected source with only `key`, `instanceId`, and the PromQL query. It never asks for or sends `username`/`password`/`bearerToken`. As a result, every authenticated Prometheus-compatible source is unusable from the UI. ### Reproduction 1. Add a Prometheus data source whose authentication is `Basic Auth` or `Bearer Token`. 2. Open an instance page and select that source in Metrics Explorer. 3. Observe that no credential prompt is shown and the query is sent without credentials. 4. The protected metrics backend rejects the request. ### Expected behavior When an authenticated source is selected, Metrics Explorer should ask for the required credentials before querying, pass them only in that query request, and clear them when the source is left. Secrets must remain in memory and must not be stored in Settings, browser storage, or the URL. ### Proposed tests - Basic Auth selection does not query until username/password are entered, then sends them in `queryByDataSource`. - Bearer selection sends the token. - Leaving and reselecting an authenticated source requires credentials again. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
