Aias00 opened a new issue, #7216: URL: https://github.com/apache/rocketmq-dashboard/issues/7216
### Before Creating the Bug Report - [x] Searched all-state issues and PRs for AuthInterceptor, ThreadLocal/SSE, asynchronous context cleanup, and afterConcurrentHandlingStarted. - [x] This is a RocketMQ Studio defect. ### Studio Version `rocketmq-studio` at `127c47b06a268cc74224d5f34c56ec7c36ac0d55`. ### Runtime Environment Spring MVC asynchronous requests, including the AI SSE send and attach endpoints. Deterministic reproduction uses MockMvc's real DispatcherServlet lifecycle with an open SseEmitter; no provider, broker, or database is required. ### Connected RocketMQ Cluster Not involved. ### Describe the Bug `AuthInterceptor` implements HandlerInterceptor and clears AuthenticatedUserContext only in afterCompletion. On an async handoff, Spring invokes AsyncHandlerInterceptor.afterConcurrentHandlingStarted instead of afterCompletion on the original request thread. This interceptor does not implement that callback, so the authenticated user ID, name, and admin flag remain on the pooled servlet thread when it returns to the container. An eventual async dispatch runs on a potentially different thread and cannot clear the original thread's ThreadLocal. preHandle clears the context at the next intercepted API request, which limits exposure, but handlers outside /api/** do not pass through that cleanup. This report identifies leaked request identity; it does not claim a demonstrated API authorization bypass. ### Steps to Reproduce 1. Register the real AuthInterceptor in MockMvc, with authentication returning an admin principal. 2. Send an authenticated GET to an endpoint returning an uncompleted SseEmitter. 3. Confirm async processing has started and that the controller saw the principal. 4. Inspect AuthenticatedUserContext on the calling request thread after perform returns: it still contains the principal rather than the clean system context. ### Expected Behavior Clear all request-thread identity fields when MVC hands the request off asynchronously, while preserving synchronous afterCompletion cleanup and reauthentication on async redispatch. ### Related Work #695 added ordinary request-completion cleanup. PR #5051 concerns preHandle rejection with 403. Neither covers Spring MVC's async handoff, where afterCompletion is skipped on the originating thread. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
