This is an automated email from the ASF dual-hosted git repository.
lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git
The following commit(s) were added to refs/heads/rocketmq-studio by this push:
new 148cb694d docs: sync the Chinese README login description with the
code (#4729)
148cb694d is described below
commit 148cb694dccaa54b3621ad064e424815ddcd511c
Author: Apulupie <[email protected]>
AuthorDate: Mon Sep 21 21:12:11 2026 +0800
docs: sync the Chinese README login description with the code (#4729)
The login section of `README_zh.md` told readers that the login endpoint
only accepts the users named in the configuration. That is wrong in both
directions: `AuthService.ensureBootstrapUsers` returns immediately once
`rmq_studio_user` has any row, and it runs at login time rather than at
startup, so the configured accounts are a seed for an empty database and every
account created afterwards on the user-management page authenticates just the
same. `AuthService`'s own class javadoc st [...]
The paragraph now mirrors the English text point for point: the configured
credentials are a bootstrap seed, the first login against an empty database
writes them to `rmq_studio_user`, the database is the source of truth
afterwards, administrators create, enable, disable and reset passwords on the
user-management page, browsers authenticate with an `HttpOnly` session cookie
and API clients can request a bearer token explicitly. The existing closing
sentence about disabling login prote [...]
Fixes #4730
---
README_zh.md | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/README_zh.md b/README_zh.md
index 1a5aed13f..535b7ac00 100644
--- a/README_zh.md
+++ b/README_zh.md
@@ -27,8 +27,11 @@ rocketmq-web）。启动 Studio 前可用
共享环境可复制 `deploy/.env.example` 为 `deploy/.env`，设置
`STUDIO_AUTH_LOGIN_REQUIRED=true`，并配置 `STUDIO_AUTH_ADMIN_USERNAME` /
-`STUDIO_AUTH_ADMIN_PASSWORD` 开启登录保护。登录接口仅接受已配置用户；
-关闭登录保护只会跳过本地开发场景下的 API 拦截。
+`STUDIO_AUTH_ADMIN_PASSWORD` 开启登录保护。这里配置的账号只是引导种子：
+针对空数据库的首次登录会把配置的用户写入 `rmq_studio_user` 表，此后数据库
+才是账号与账号状态的唯一来源。管理员可以在用户管理页维护账号（创建用户、
+启用/停用、重置密码）；浏览器使用 `HttpOnly` 会话 Cookie 认证，API 客户端
+可显式换取 bearer token。关闭登录保护只会跳过本地开发场景下的 API 拦截。
## 界面预览
