RockteMQ-AI commented on issue #2164:
URL:
https://github.com/apache/rocketmq-dashboard/issues/2164#issuecomment-5289701084
**Issue Evaluation**
Category: `bug` | Status: **Confirmed**
The reported issue has been verified against the codebase at commit
`e1072d2`.
**Root Cause:** Two production code paths access `localStorage` directly
without try/catch, bypassing the safe wrappers already defined in
`authStorage.ts`:
1. **`web/src/api/client.ts:70`** — The Axios request interceptor calls
`localStorage.getItem(TOKEN_STORAGE_KEY)` directly. A `SecurityError` here
rejects every API request before it is sent. The safe `readAuthSession()` in
`authStorage.ts` already handles this case but is not used by the interceptor.
2. **`web/src/pages/studio/Proxy.tsx:70`** — `useState` initializer calls
`localStorage.getItem('clusterId')` without protection. A `SecurityError`
crashes the component during render.
3. **`web/src/pages/studio/Proxy.tsx:145`** — `handleClusterIdChange` calls
`localStorage.setItem('clusterId', value)` without try/catch.
**Impact:** In privacy-restricted or sandboxed browser contexts (where Web
Storage throws `SecurityError`), the entire Studio UI becomes non-functional —
API requests fail and the Proxy page cannot render.
**Severity:** medium — affects users in restricted browser environments;
standard browser usage is unaffected.
An automated fix proposal can be generated. Reply `/approve` to proceed with
PR generation.
---
*Automated evaluation by github-manager-bot*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
