youngkermit8-coder opened a new issue, #2378: URL: https://github.com/apache/rocketmq-dashboard/issues/2378
## Problem `LoginRateLimiter` stores failed-login state in an in-memory map keyed by normalized username. Entries below the five-failure lock threshold are not removed unless the same username later succeeds, and the map has no capacity limit. An unauthenticated client can therefore submit one failed login for each changing username. None of those entries expires through the current access path, so the process retains an unbounded number of keys. ## Reproduction 1. Create a `LoginRateLimiter`. 2. Call `recordFailure` once for 10,001 distinct usernames. 3. Observe that every call is accepted and all per-username states remain tracked. A regression test that expects the 10,001st distinct username to be rejected with HTTP 429 fails on the current `rocketmq-studio` head because no exception is raised. ## Expected behavior - Bound the total number of usernames tracked in memory. - Reclaim expired failure windows and lockouts when capacity is under pressure. - Fail closed for a new failed username when capacity remains exhausted. - Preserve the existing per-username five-attempt lock behavior, including under concurrent admission. - Do not block a correct login solely because unrelated failed usernames filled the tracking map. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
