This is an automated email from the ASF dual-hosted git repository.
lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git
The following commit(s) were added to refs/heads/rocketmq-studio by this push:
new d0c42241 fix: allow CORS preflight before authentication (#720)
d0c42241 is described below
commit d0c422411df9a4071843ab3ef9bc319318427501
Author: Rui <[email protected]>
AuthorDate: Mon Aug 3 11:13:04 2026 +0800
fix: allow CORS preflight before authentication (#720)
---
.../rocketmq/studio/auth/AuthInterceptor.java | 4 +-
.../studio/auth/AuthCorsIntegrationTest.java | 84 ++++++++++++++++++++++
2 files changed, 87 insertions(+), 1 deletion(-)
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
b/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
index 93ce5442..4d167137 100644
--- a/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
+++ b/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
@@ -23,6 +23,7 @@ import lombok.RequiredArgsConstructor;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
+import org.springframework.web.cors.CorsUtils;
import org.springframework.web.servlet.HandlerInterceptor;
@RequiredArgsConstructor
@@ -34,7 +35,8 @@ public class AuthInterceptor implements HandlerInterceptor {
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse
response,
Object handler) throws Exception {
- if (!authProperties.isLoginRequired() ||
isPublicPath(requestPath(request))) {
+ if (!authProperties.isLoginRequired() ||
CorsUtils.isPreFlightRequest(request)
+ || isPublicPath(requestPath(request))) {
return true;
}
if
(authService.isAuthenticated(request.getHeader(HttpHeaders.AUTHORIZATION))) {
diff --git
a/server/src/test/java/org/apache/rocketmq/studio/auth/AuthCorsIntegrationTest.java
b/server/src/test/java/org/apache/rocketmq/studio/auth/AuthCorsIntegrationTest.java
new file mode 100644
index 00000000..0818af6d
--- /dev/null
+++
b/server/src/test/java/org/apache/rocketmq/studio/auth/AuthCorsIntegrationTest.java
@@ -0,0 +1,84 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.rocketmq.studio.auth;
+
+import org.apache.rocketmq.studio.common.config.CorsConfig;
+import org.apache.rocketmq.studio.instance.InstanceController;
+import org.apache.rocketmq.studio.instance.InstanceService;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import
org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
+import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
+import org.springframework.boot.test.mock.mockito.MockBean;
+import org.springframework.context.annotation.Import;
+import org.springframework.http.HttpHeaders;
+import org.springframework.test.web.servlet.MockMvc;
+
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoMoreInteractions;
+import static org.mockito.Mockito.when;
+import static
org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static
org.springframework.test.web.servlet.request.MockMvcRequestBuilders.options;
+import static
org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
+import static
org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+@WebMvcTest(value = InstanceController.class, properties =
"studio.auth.login-required=true")
+@AutoConfigureMockMvc(addFilters = false)
+@Import({AuthWebConfig.class, CorsConfig.class})
+class AuthCorsIntegrationTest {
+
+ private static final String FRONTEND_ORIGIN = "https://studio.example.com";;
+
+ @Autowired
+ private MockMvc mockMvc;
+
+ @MockBean
+ private InstanceService instanceService;
+
+ @MockBean
+ private AuthProperties authProperties;
+
+ @MockBean
+ private AuthService authService;
+
+ @BeforeEach
+ void enableLoginProtection() {
+ when(authProperties.isLoginRequired()).thenReturn(true);
+ }
+
+ @Test
+ void shouldAllowCorsPreflightWithoutAuthentication() throws Exception {
+ mockMvc.perform(options("/api/instances")
+ .header(HttpHeaders.ORIGIN, FRONTEND_ORIGIN)
+ .header(HttpHeaders.ACCESS_CONTROL_REQUEST_METHOD,
"GET"))
+ .andExpect(status().isOk())
+
.andExpect(header().string(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "*"));
+
+ verifyNoMoreInteractions(authService);
+ }
+
+ @Test
+ void shouldStillRejectAnonymousProtectedRequests() throws Exception {
+ mockMvc.perform(get("/api/instances")
+ .header(HttpHeaders.ORIGIN, FRONTEND_ORIGIN))
+ .andExpect(status().isUnauthorized());
+
+ verify(authService).isAuthenticated(null);
+ }
+}
