youngkermit8-coder opened a new issue, #1692:
URL: https://github.com/apache/rocketmq-dashboard/issues/1692
## Security bug
The two administrator-only credential reveal endpoints return plaintext
access/secret keys in ordinary GET responses without `Cache-Control: no-store`:
- `GET /api/acl/users/{id}/credentials`
- `GET /api/cloud-credentials/{id}/credentials`
Without an explicit no-store directive, browsers and intermediary caches are
permitted to retain these highly sensitive responses. Authentication and
authorization restrict who can request them, but they do not prevent a
previously authorized response from being written to a cache.
## Reproduction
Focused MockMvc tests on current `rocketmq-studio` call both endpoints and
inspect the response headers. Both return HTTP 200 with plaintext credential
fields and no `Cache-Control` header.
## Expected behavior
Every response that exposes stored credentials must include `Cache-Control:
no-store`, matching the existing treatment of authentication status responses.
## Proposed scope
- return no-store `ResponseEntity` responses from both credential reveal
handlers;
- keep response bodies and endpoint URLs backward compatible;
- add controller regressions for both endpoints.
## Duplicate check
Searched open and closed issues and pull requests for credential response
caching, `Cache-Control`, `no-store`, browser cache, ACL secrets, and cloud
credential reveal. No matching contribution was found.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
