Aias00 opened a new issue, #2320: URL: https://github.com/apache/rocketmq-dashboard/issues/2320
## Finding The default configuration leaves Dashboard management routes unauthenticated. ## Scope Make secure access the default: require authentication for management routes, keep only explicit bootstrap/login/CSRF paths public, and protect or remove the test task endpoint. ## Acceptance criteria - An unauthenticated request cannot invoke administrative, messaging, ACL, or test actions. - Public exceptions are explicit and covered by integration tests. - A production-safe configuration is documented. Source: security review of current `master`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
