yuluo-yx opened a new issue, #2892: URL: https://github.com/apache/rocketmq-dashboard/issues/2892
### Problem\n\nWhen login enforcement is enabled, AuthInterceptor.preHandle first calls AuthService.isAuthenticated and then calls AuthService.getAuthenticatedUser. isAuthenticated delegates to getAuthenticatedUser, so a database-backed session is loaded twice for every protected request.\n\nBesides the duplicate session and user reads, revocation between the two lookups can produce an inconsistent decision: the first lookup authenticates the request while the second lookup no longer supplies an authenticated user context.\n\n### Reproduction\n\n1. Enable Studio login.\n2. Authenticate and send a request to a protected endpoint such as GET /api/clusters.\n3. Spy on AuthService.getAuthenticatedUser.\n4. The current interceptor resolves the same bearer token twice.\n\nA focused AuthInterceptorTest regression reproduces the call count and fails against the current implementation.\n\n### Expected behavior\n\nResolve the authenticated user once, reject an empty result immediately, and use that same snapshot for the request context and authorization decision.\n\n### Scope\n\nAuthInterceptor and its focused unit test only. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
