ai-yang opened a new issue, #664:
URL: https://github.com/apache/rocketmq-dashboard/issues/664
## Problem
RocketMQ Studio supports configurable backend API protection through
`STUDIO_AUTH_LOGIN_REQUIRED=true` (introduced by #533), but the frontend does
not guard management routes.
When login protection is enabled, an unauthenticated user can still open a
management route such as `/instance/topic`. The page shell renders, its API
calls receive `401 Unauthorized`, and the shared response interceptor clears
the local session and reloads `/`. Because `/` is also unguarded, the user is
not routed to `/login` and can repeatedly trigger unauthorized requests.
## Reproduction
1. Start Studio with:
- `STUDIO_AUTH_LOGIN_REQUIRED=true`
- a configured admin username and password
2. Open `/instance/topic` in a private browser session without a token.
3. Observe that the management layout renders and API requests fail with 401
instead of navigating to the login page.
## Expected behavior
- The frontend should discover whether login protection is enabled.
- Protected management routes should render only when login is disabled or
the current bearer token is valid.
- Missing, expired, or revoked sessions should be cleared and redirected to
`/login`.
- Mock-only frontend development should continue to work without a backend.
- A backend availability failure during the auth check should show a retry
state rather than expose protected pages.
## Proposed atomic scope
- Add a public, non-cacheable `GET /api/auth/status` endpoint returning:
- `loginRequired`
- `authenticated`
- Exempt only that status endpoint from the auth interceptor.
- Add a frontend route guard around management routes.
- Keep the existing login/logout and token format unchanged.
- Add focused backend and frontend regression tests.
- Keep the change around 10 files and avoid `api/client.ts`, so it does not
overlap the active CSRF work in #662.
This is a Track 1 / BASE-01 login-flow correctness fix and a small follow-up
to the architecture scope in #427.
## Validation
- Backend controller and interceptor tests
- Frontend auth API and route guard tests
- Full `mvn test`, frontend test/lint/build
- Manual verification with login protection enabled and disabled
I would like to claim and implement this atomic fix.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
