89799969 opened a new pull request, #4475: URL: https://github.com/apache/rocketmq-dashboard/pull/4475
### Which Issue(s) This PR Fixes - Fixes #4159 ### Brief Description `loginDatabaseUser` still answers an unknown username with an immediate `401` and no PBKDF2 derivation. Disabled accounts already burn `DUMMY_PASSWORD_HASH` so their timing matches a wrong password on an enabled account, but unknown usernames stay measurably faster. An unauthenticated caller can therefore distinguish "account exists" from "account does not exist" by response latency alone. Burn the same dummy derivation before answering for a missing user. The residual left after trunk #4339 covered the disabled-account path. Previously submitted as #4319 against the removed `rocketmq-studio` branch (bulk-closed during the master migration). Replayed on the current `master` baseline; issue #4159 is still open and no open PR claims it. ### How Did You Test This Change? ``` cd server && mvn -B -ntp -Dtest=AuthServiceDatabaseTest test ``` Tests run: 28, Failures: 0, Errors: 0, Skipped: 0 (includes the new `unknownAccountsGetTheUniformInvalidCredentialsResponse` case). ``` cd server && mvn -B -ntp -DskipTests checkstyle:check ``` 0 Checkstyle violations. ### Checklist - [x] One coherent change; unrelated modifications are not bundled in - [x] Commit subject follows Conventional Commits (`fix:`) - [x] Tests added or updated for non-trivial changes, test methods named `...Test` - [x] No new UI text - [x] Focused backend tests and Checkstyle pass - [x] No new source files - [x] No documentation change is needed for this timing-equality correction -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
