unbridled-41 commented on PR #4160: URL: https://github.com/apache/rocketmq-dashboard/pull/4160#issuecomment-5680371932
@lizhimins Thanks for the detailed trade-off notes — reworked as #4339. It adds the disabled + correct password case, keeps the disabled short-circuit ahead of the expensive hash (the stored hash is never used), and answers with a uniform 401 after one dummy PBKDF2 verification — the dummy-hash / uniform-response options from your review. The resulting 403→401 change for disabled accounts that present the correct password is called out explicitly in the PR description; please confirm that behavior change is acceptable, and I'm happy to rework if you'd prefer keeping the 403. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
