zhaohai666 opened a new pull request, #662:
URL: https://github.com/apache/rocketmq-dashboard/pull/662
## Summary
Add CSRF (Cross-Site Request Forgery) protection to the HTTP client to
complement the backend's CookieCsrfTokenRepository configuration.
- Read XSRF-TOKEN from cookies (set by backend with httpOnly=false)
- Request interceptor now attaches X-XSRF-TOKEN header for mutating
methods: POST, PUT, DELETE, PATCH
- On first request, if XSRF cookie is not present, fetch
`/rocketmq-dashboard/csrf-token` endpoint to trigger cookie creation
- Deduplicate concurrent CSRF fetch requests via shared promise
- Non-mutating requests (GET, HEAD, OPTIONS) are unaffected
## Test plan
- [ ] GET requests should NOT include X-XSRF-TOKEN header
- [ ] POST/PUT/DELETE requests should include X-XSRF-TOKEN from cookie
- [ ] First mutating request should trigger /csrf-token fetch if no cookie
- [ ] Existing Authorization header behavior unchanged
- [ ] 401 handling and auth session clearing still work correctly
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
