youngkermit8-coder opened a new issue, #2380: URL: https://github.com/apache/rocketmq-dashboard/issues/2380
### Description `AuthInterceptor.preHandle` resolves the same bearer session repeatedly for every protected request: 1. `isAuthenticated` delegates to `getAuthenticatedUser`. 2. `getAuthenticatedUser` is called again to populate `AuthenticatedUserContext`. 3. Admin-only requests call `isAdmin`, which delegates to `getAuthenticatedUser` a third time. With persistent authentication, each resolution selects both the session and its user. A reader request therefore performs four authentication SELECTs and an admin request performs six before the controller runs. The repeated reads also evaluate one request against multiple database snapshots. ### Expected behavior Resolve the authenticated user once per request, use that result for the unauthorized decision, populate the request context, and read the role from the same user snapshot for authorization. ### Proposed fix Replace the three helper calls in `AuthInterceptor` with one `getAuthenticatedUser` call and add a regression test that rejects additional authentication or role lookups during one admin request. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
