tju-yxq opened a new pull request, #3046: URL: https://github.com/apache/rocketmq-dashboard/pull/3046
## What is the purpose of the change The login limiter currently has two fail-open paths. A request that passed `checkAllowed` before another request established a lock can call `recordFailure` later and replace that active lock with a new one-failure state. Also, once the exact username map reaches its size bound, failures for every new username are ignored, so filling the map with decoy names disables limiter protection for later usernames. ## What changed - preserve an active lock when a later in-flight failure is recorded; only expiration or successful login clears it - add a fixed-size overflow bucket layer used only while the exact tracker is saturated, so new usernames still receive bounded failure counting and lockout without growing memory - reclaim expired exact entries and reset overflow state when exact capacity becomes available, avoiding stale collision effects - keep all limiter state transitions under one synchronization boundary and keep active exact locks stable across capacity pressure - add deterministic tests for both RED reproductions, bounded overflow state, protected active locks, and collision isolation ## Verification - before the fix, both regression tests failed: a late `recordFailure` made the locked username allowed, and a target username bypassed limiting after decoys filled the exact tracker - focused auth tests: `LoginRateLimiterTest,AuthServiceTest,AuthServiceDatabaseTest,AuthControllerTest` (42 tests) passed - Checkstyle: 0 violations - full server suite: `mvn -DskipTests=false test` (1,964 tests, 0 failures, 0 errors) Closes #3045 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
