Aias00 opened a new issue, #878:
URL: https://github.com/apache/rocketmq-dashboard/issues/878
### Before Creating the Bug Report
- [x] I found a bug, not just asking a question, which should be created in
GitHub Issues.
- [x] I have searched the existing issues and believe this is not a
duplicate.
- [x] I have confirmed that this bug belongs to the current repository.
### Describe the Bug
`AuthInterceptor#isPublicPath` only allows exact matches for
`/api/auth/login` and `/api/auth/status`:
```java
return path.equals("/api/auth/login")
|| path.equals("/api/auth/status")
|| ...;
```
When login is required, common gateway or proxy path variants such as
`/api/auth/status/` are rejected with 401 even though they represent the same
public endpoint. This can break frontend auth status checks behind
path-normalizing proxies.
### Expected Behavior
The interceptor should normalize a single trailing slash for public path
checks, while keeping the public endpoint allow-list strict.
`/api/auth/status/` and `/api/auth/login/` should be treated the same as their
canonical forms.
### Scope
RocketMQ Studio Track 1 / BASE-01 login and permission baseline. This is a
small compatibility hardening in the Console authentication interceptor.
### Proposed Fix
Normalize the request path before public-path comparison by trimming
trailing slashes except for `/`. Add regression tests for the login and status
public endpoints with trailing slashes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
