RockteMQ-AI commented on issue #568: URL: https://github.com/apache/rocketmq-dashboard/issues/568#issuecomment-5771463991
**Issue Evaluation** Category: `enhancement` | Status: **Evaluated** This is a well-structured security improvement proposal for ACL credential handling. **Assessment:** - Returning complete credentials only at creation time is the correct security pattern - Masking in list/update responses prevents credential leakage through the API - Merging editable metadata with stored user (instead of full replacement) avoids accidental credential overwrite - Frontend changes to remove credential fields from update payloads are necessary to complete the fix **Feasibility:** Feasible — changes are localized to ACL user management endpoints and the frontend ACL page. **Scope:** Backend ACL service + controller, frontend ACL user management component. **Compatibility:** No breaking changes expected — masked responses are a security improvement that existing consumers should handle gracefully. This issue is ready for implementation. A maintainer can pick it up or community members can contribute a PR. --- *Automated evaluation by github-manager* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
