89799969 opened a new pull request, #4319:
URL: https://github.com/apache/rocketmq-dashboard/pull/4319
Fixes #4159
## Problem
`AuthService.loginDatabaseUser` checks whether the Studio user is enabled
**before** comparing the password:
```java
if (!Boolean.TRUE.equals(user.getEnabled())) {
throw new BusinessException(403, "User account is disabled"); // before
password check
}
if (!passwordHasher.matches(...)) {
throw new BusinessException(401, "Invalid username or password");
}
```
Consequences:
1. **Account enumeration** — an unauthenticated caller can distinguish
disabled accounts (`403 User account is disabled`) from wrong passwords (`401
Invalid username or password`) without knowing the secret.
2. **Rate-limiter bypass** — `login()` only records a failed attempt when
the exception code is `401`. The early `403` path never increments the failure
counter, so disabled-account probing is unlimited.
## Fix
Verify the password hash first. A wrong secret is always an
indistinguishable `401` and counts toward the rate limiter. Only a **matching**
password on a disabled account yields `403`.
## Testing
- `AuthServiceDatabaseTest` (23 tests, including 2 new regression cases):
- wrong password on a disabled account → `401` (not `403`)
- correct password on a disabled account → `403`, no session insert
```
Tests run: 23, Failures: 0, Errors: 0, Skipped: 0
```
Local run: Temurin 21.0.12.1, `mvn -Dtest=AuthServiceDatabaseTest test`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
