pilichoumao opened a new issue, #6897: URL: https://github.com/apache/rocketmq-dashboard/issues/6897
### Description On rocketmq-studio at a92c23144408cdf5729707050e9ecd9b75f1bad0, MetricsExplorer persists query history to the global browser key `rocketmq-studio-metrics-query-history`. Logging out clears authentication state but leaves this key. Another account using the same browser and Studio origin can see the previous account's PromQL, instance identifiers, data source names and summary, or clear that account's history. This concerns local browser history isolation; it does not establish a server authorization bypass or credential disclosure. ### Reproduction 1. Sign in as account A, run a metrics query, and sign out. 2. Sign in as B on the same browser/origin and open metrics query history. 3. A's record is still loaded. B's Clear history also removes A's records. ECS tests with the exact auth store and history helpers reproduced four failures (account switch, logout, clearing another account's history, unowned legacy history), with the same-account restore control passing. ### Proposed compatibility behavior for review - Version the browser keys and scope signed-in histories by stable user ID; use username only when an ID is unavailable. - Keep a separate anonymous scope for auth-disabled/mock deployments rather than disabling their history. - Do not assign the legacy global key to the first new account: its owner cannot be established. Leave it untouched and unread, and document this behavior. - Remount/reset account-specific metrics state on identity changes. Bind writes to the initiating scope and reject late responses after identity changes, preserving the existing clear-generation and out-of-order protections from #6394 and #6377. - Same-account reloads retain history; clearing one scope leaves others intact. Related but distinct: #5922 scopes AI composer drafts; #6168 scopes prompt templates. Neither touches metric query history. #5156 manages server-side message history. The migration and anonymous-scope policy are stated here for maintainer review. Any implementation PR will remain draft pending agreement on these compatibility choices. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
