lizhimins commented on PR #4160: URL: https://github.com/apache/rocketmq-dashboard/pull/4160#issuecomment-5679163458
Thanks for the careful read of the login path — the observation that a 403 before password verification discloses account state is a fair one. We're going to close this as-is, though, because the trade-offs aren't settled. After the swap, an unauthenticated caller can make the server run a full 210k-iteration PBKDF2 derivation against accounts that can never authenticate, and disabled-account attempts start consuming the per-username lockout budget that previously only counted credential failures — both are policy changes rather than bug fixes. More concretely, neither new test covers "disabled account + correct password", which is the one behaviour that must not regress, so the 403 path is left unpinned. If you'd like to rework this, please add that case and keep the disabled short-circuit ahead of the expensive hash (e.g. verify against a dummy hash, or return a uniform 401 without disclosing state). We'd be glad to review that version. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
