This is an automated email from the ASF dual-hosted git repository.
lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git
The following commit(s) were added to refs/heads/rocketmq-studio by this push:
new 58e3e0d3 fix(security): disable caching for credential reveal
responses (#1695)
58e3e0d3 is described below
commit 58e3e0d34498b69283f6a8fca0a877a1657f931f
Author: youngkermit8-coder <[email protected]>
AuthorDate: Tue Aug 11 20:50:02 2026 +0800
fix(security): disable caching for credential reveal responses (#1695)
Signed-off-by: youngkermit8-coder <[email protected]>
---
.../studio/instance/acl/AclController.java | 8 +++-
.../credential/CloudCredentialController.java | 8 +++-
.../studio/instance/acl/AclControllerTest.java | 16 +++++++
.../credential/CloudCredentialControllerTest.java | 54 ++++++++++++++++++++++
4 files changed, 82 insertions(+), 4 deletions(-)
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclController.java
b/server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclController.java
index 36bc8e9a..a08da8a0 100644
---
a/server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclController.java
+++
b/server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclController.java
@@ -21,6 +21,8 @@ import org.apache.rocketmq.studio.common.domain.Result;
import org.apache.rocketmq.studio.common.exception.BusinessException;
import jakarta.validation.Valid;
import lombok.RequiredArgsConstructor;
+import org.springframework.http.CacheControl;
+import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.PostMapping;
@@ -81,8 +83,10 @@ public class AclController {
}
@GetMapping("/users/{id}/credentials")
- public Result<AclUserVO> getUserCredentials(@PathVariable String id) {
- return Result.ok(aclService.getUserCredentials(id));
+ public ResponseEntity<Result<AclUserVO>> getUserCredentials(@PathVariable
String id) {
+ return ResponseEntity.ok()
+ .cacheControl(CacheControl.noStore())
+ .body(Result.ok(aclService.getUserCredentials(id)));
}
@PostMapping("/users/create")
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/provider/credential/CloudCredentialController.java
b/server/src/main/java/org/apache/rocketmq/studio/provider/credential/CloudCredentialController.java
index 40f99a74..e7b88b6c 100644
---
a/server/src/main/java/org/apache/rocketmq/studio/provider/credential/CloudCredentialController.java
+++
b/server/src/main/java/org/apache/rocketmq/studio/provider/credential/CloudCredentialController.java
@@ -20,6 +20,8 @@ import jakarta.validation.Valid;
import org.apache.rocketmq.studio.common.domain.DeleteRequestDTO;
import org.apache.rocketmq.studio.common.domain.Result;
import org.apache.rocketmq.studio.common.exception.BusinessException;
+import org.springframework.http.CacheControl;
+import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.PostMapping;
@@ -67,7 +69,9 @@ public class CloudCredentialController {
}
@GetMapping("/{id}/credentials")
- public Result<CloudCredentialVO> getCredentialSecrets(@PathVariable String
id) {
- return Result.ok(credentialService.reveal(id));
+ public ResponseEntity<Result<CloudCredentialVO>>
getCredentialSecrets(@PathVariable String id) {
+ return ResponseEntity.ok()
+ .cacheControl(CacheControl.noStore())
+ .body(Result.ok(credentialService.reveal(id)));
}
}
diff --git
a/server/src/test/java/org/apache/rocketmq/studio/instance/acl/AclControllerTest.java
b/server/src/test/java/org/apache/rocketmq/studio/instance/acl/AclControllerTest.java
index 773f1f2a..0f55ca79 100644
---
a/server/src/test/java/org/apache/rocketmq/studio/instance/acl/AclControllerTest.java
+++
b/server/src/test/java/org/apache/rocketmq/studio/instance/acl/AclControllerTest.java
@@ -25,6 +25,7 @@ import org.springframework.beans.factory.annotation.Autowired;
import
org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
import org.springframework.boot.test.mock.mockito.MockBean;
+import org.springframework.http.HttpHeaders;
import org.springframework.http.MediaType;
import org.springframework.test.web.servlet.MockMvc;
@@ -41,6 +42,7 @@ import static org.mockito.Mockito.verifyNoInteractions;
import static org.mockito.Mockito.when;
import static
org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static
org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
+import static
org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
import static
org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
import static
org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
@@ -265,6 +267,20 @@ class AclControllerTest {
.andExpect(jsonPath("$.data[0].admin").value(true));
}
+ @Test
+ void getUserCredentialsShouldDisableResponseCaching() throws Exception {
+ AclUserVO credentials = AclUserVO.builder()
+ .id("user-1")
+ .accessKey("access-key")
+ .secretKey("secret-key")
+ .build();
+ when(aclService.getUserCredentials("user-1")).thenReturn(credentials);
+
+ mockMvc.perform(get("/api/acl/users/user-1/credentials"))
+ .andExpect(status().isOk())
+ .andExpect(header().string(HttpHeaders.CACHE_CONTROL,
"no-store"));
+ }
+
@Test
void createUserShouldReturnGeneratedCredentials() throws Exception {
AclUserVO created = AclUserVO.builder()
diff --git
a/server/src/test/java/org/apache/rocketmq/studio/provider/credential/CloudCredentialControllerTest.java
b/server/src/test/java/org/apache/rocketmq/studio/provider/credential/CloudCredentialControllerTest.java
new file mode 100644
index 00000000..82ac42f3
--- /dev/null
+++
b/server/src/test/java/org/apache/rocketmq/studio/provider/credential/CloudCredentialControllerTest.java
@@ -0,0 +1,54 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.studio.provider.credential;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import
org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
+import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
+import org.springframework.boot.test.mock.mockito.MockBean;
+import org.springframework.http.HttpHeaders;
+import org.springframework.test.web.servlet.MockMvc;
+
+import static org.mockito.Mockito.when;
+import static
org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static
org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
+import static
org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+@WebMvcTest(CloudCredentialController.class)
+@AutoConfigureMockMvc(addFilters = false)
+class CloudCredentialControllerTest {
+
+ @Autowired
+ private MockMvc mockMvc;
+
+ @MockBean
+ private CloudCredentialService credentialService;
+
+ @Test
+ void getCredentialSecretsShouldDisableResponseCaching() throws Exception {
+ CloudCredentialVO credentials = new CloudCredentialVO();
+ credentials.setId("credential-1");
+ credentials.setAccessKey("access-key");
+ credentials.setSecretKey("secret-key");
+ when(credentialService.reveal("credential-1")).thenReturn(credentials);
+
+ mockMvc.perform(get("/api/cloud-credentials/credential-1/credentials"))
+ .andExpect(status().isOk())
+ .andExpect(header().string(HttpHeaders.CACHE_CONTROL,
"no-store"));
+ }
+}
