89799969 opened a new pull request, #5065:
URL: https://github.com/apache/rocketmq-dashboard/pull/5065
<!-- Make sure the base branch is `master`: that is the RocketMQ Studio
trunk. -->
### Which Issue(s) This PR Fixes
<!-- Link the issue with a keyword so it closes on merge. Trivial fixes need
no issue.
https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue
-->
- Fixes #4159
### Brief Description
`loginDatabaseUser` still answers an unknown username with an immediate
`401` and no PBKDF2 derivation. Disabled accounts already burn
`DUMMY_PASSWORD_HASH` so their timing matches a wrong password on an enabled
account, but unknown usernames stay measurably faster. An unauthenticated
caller can therefore distinguish "account exists" from "account does not exist"
by response latency alone.
Burn the same dummy derivation before throwing for unknown usernames.
Resubmit of #4475 (auto-closed by the 7-day stale bot while waiting for
human review).
### How Did You Test This Change?
- Extended `AuthServiceDatabaseTest` for the unknown-username path
- `cd server && mvn -B -ntp test` focused auth tests green
### Checklist
- [x] One coherent change; unrelated modifications are not bundled in
- [x] Commit subject follows Conventional Commits (`feat:` / `fix:` /
`refactor:` / `chore:` / `docs:` / `perf:`)
- [x] Tests added or updated for non-trivial changes, test methods named
`...Test`
- [ ] New UI text has both Chinese and English entries under `web/src/i18n/`
- [x] Architecture constraints stay green (`mvn test` runs the ArchUnit
checks)
- [ ] New source files carry the ASF license header
- [ ] Documentation touched where behaviour changed (README / `docs/` /
in-app help)
### AI disclosure
Implemented with the assistance of an AI coding agent.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
