aiceflower opened a new pull request, #5458: URL: https://github.com/apache/linkis/pull/5458
## Summary `getLoginUserIgnoreTimeout` previously skipped `isTimeoutOrNot` entirely — any ticket that decrypted cleanly (with the known default key) was accepted even if it was never registered via `setLoginUser`. This was the second half of the auth bypass. This PR adds `isTimeoutOrNot` for all normal users even in the ignore-timeout path. The only exception is `OTHER_SYSTEM_IGNORE_UM_USER` (internal RPC identity via header). ## Changes - `SSOUtils.getLoginUserIgnoreTimeout`: normal users now go through `isTimeoutOrNot` (session map lookup) - `OTHER_SYSTEM_IGNORE_UM_USER` remains exempt (internal RPC, not browser-cookie-based) ## Affected files - `linkis-commons/linkis-module/.../SSOUtils.scala` (+20/-1) ## Deployment impact | Scenario | Impact | |---|---| | HA mode (Redis session sharing) | No impact | | Non-HA (standalone session maps) | Gateway→backend may fail; switch to HA mode recommended | 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
