youngkermit8-coder opened a new pull request, #2379: URL: https://github.com/apache/rocketmq-dashboard/pull/2379
## Summary - cap failed-login state at 10,000 distinct normalized usernames - reclaim expired failure windows and lockouts when capacity is under pressure - fail closed with HTTP 429 for a new failed username while the cap remains exhausted - reject usernames over 128 characters before they enter rate-limit tracking - preserve the existing five-failure per-username lock and allow correct logins when unrelated tracking is full ## Root cause and impact `LoginRateLimiter` retained one map entry for every distinct username that failed authentication. Entries below the lock threshold were never removed unless that username later logged in successfully, and there was no aggregate capacity limit. An unauthenticated client could therefore submit one failure for each changing username and grow the map without bound. Admission is now serialized so concurrent usernames cannot cross the cap. A capacity-triggered sweep removes expired entries, with sweeps throttled to once per 30 seconds to avoid repeated full-map scans. Correct credentials are still authenticated before failure state is recorded, so unrelated capacity pressure does not block a successful login. ## Validation - the capacity regression failed on the unmodified base because the 10,001st username did not raise an exception - authentication/rate-limit/controller tests: 44 passed - full Maven suite: 1,360 tests passed, 0 failures/errors/skips - concurrent regression: exactly 8 of 64 simultaneous new usernames were admitted to a capacity-8 limiter - Checkstyle: 0 violations - `git diff --check`: passed Fixes #2378 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
