youngkermit8-coder opened a new pull request, #1695: URL: https://github.com/apache/rocketmq-dashboard/pull/1695
## Summary - return `Cache-Control: no-store` from both credential reveal endpoints - cover ACL user credentials and cloud provider credentials with controller tests ## Why These authenticated GET endpoints return plaintext access keys and secret keys. The ordinary `Result` responses did not include a cache directive, so browsers or intermediary caches could retain sensitive credential responses. Using `ResponseEntity` with `CacheControl.noStore()` keeps the JSON response shape unchanged while preventing storage of the revealed secrets. ## Validation - baseline reproduction on `rocketmq-studio` (`65d1c32`): 2 new assertions failed because `Cache-Control` was absent - `mvn -Dtest=AclControllerTest,CloudCredentialControllerTest test` - 22 tests passed - related auth, ACL, and cloud credential regression suite - 142 tests passed - Checkstyle - 0 violations - `mvn -DskipTests package` - passed Closes #1692 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
