Alanxtl commented on code in PR #3635:
URL: https://github.com/apache/dubbo-go/pull/3635#discussion_r3755078030
##########
remoting/nacos/builder.go:
##########
@@ -43,6 +43,23 @@ var (
newNacosConfigClient = nacosClient.NewNacosConfigClient
)
+// nacosClientPoolKey derives the gost client-pool key from the fields that
+// distinguish one nacos connection from another: endpoint/address, namespace
+// and credentials. Components pointing at the same cluster (registry,
+// config-center, metadata-report) resolve to the same key and share one SDK
+// client session instead of each opening its own. Role-scoped client names
+// must not be used as the key — they would defeat the sharing.
+func nacosClientPoolKey(kind string, url *common.URL) string {
Review Comment:
nacosClientPoolKey omits NacosPassword and NacosSecretKey, but
GetNacosConfig uses both in the SDK ClientConfig at builder.go. That means two
config/metadata clients pointing at the same Nacos endpoint with the same
username/accessKey but different password/secretKey will collapse to the same
shared pool key. The later caller will silently reuse the first caller’s
authenticated client, which can cause wrong-credential access, permission
failures, or cross-role credential leakage. The key should include
constant.NacosPassword and constant.NacosSecretKey, with tests proving
different password/secret values produce different pool keys.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
