RockteMQ-AI commented on issue #2031:
URL:
https://github.com/apache/rocketmq-dashboard/issues/2031#issuecomment-5269993236
**Issue Evaluation**
Category: `bug` (security) | Status: **Needs Clarification**
Thank you for reporting this potential regression. I reviewed the current
`rocketmq-studio` head at commit `103555a` and found:
1. **`AuthInterceptor.isLoginRequired()` already fails closed** — the catch
block at line ~78 explicitly returns `true` when
`settingsRepository.loadGeneralSettings()` throws:
```java
} catch (Exception exception) {
// Fail closed: when the policy cannot be read, default to requiring
login.
return true;
}
```
2. **The regression test from #1514 is present** —
`AuthInterceptorTest.shouldEnforceLoginWhenRuntimePolicyCannotBeLoaded()`
verifies that a failing `SettingsRepository` results in HTTP 401 for
unauthenticated requests.
Could you clarify which specific code path or commit you observed returning
`false` on settings failure? It is possible this was already addressed in a
subsequent commit, or there may be a different code path I am not seeing.
---
*Automated evaluation by @RockteMQ-AI*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
