RockteMQ-AI commented on issue #2710: URL: https://github.com/apache/rocketmq-dashboard/issues/2710#issuecomment-5455414396
**Issue Evaluation** Category: | Status: **Confirmed** The credential resolution order in checks the session cookie before the header. This means API clients sending a fresh Bearer token may be authenticated against a stale browser cookie instead, which is both a correctness and a security concern. **Root Cause:** Incorrect precedence in credential selection — cookie checked before explicit Bearer header. **Impact:** Authentication layer; API clients using Bearer tokens may be silently authenticated with stale sessions. **Severity:** High — authentication correctness issue with potential security implications. The proposed scope (adjust precedence + regression tests) is appropriate and important. An automated fix proposal can be generated. Reply to proceed with PR generation. --- *Automated evaluation by RockteMQ-AI* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
