[ISSUE #359] Fix Docker starts the dashboard page access address is localhost

[louyongjiu]

Fix Docker starts the dashboard page access address is localhost

[oss-sentinel-ai]

Review: Approved ✅

PR: #360 — [ISSUE #359] Fix Docker starts the dashboard page access address is localhost
Type: Bug fix (3 files, +25/-13)

Assessment

Fixes the dashboard access address issue when running in Docker. Changes include:

• Updated remoteApi.js to handle Docker environment correctly
• Modified SecurityConfig.java for proper address binding
• Updated application.yml configuration

Verdict

✅ Proper fix for Docker deployment address binding.

---

🤖 Automated review by oss-sentinel-ai

[RockteMQ-AI]

Review by github-manager-bot

Summary

Fixes the dashboard access address issue when running in Docker by making the API base URL relative and updating CORS configuration.

Findings

• [Critical] SecurityConfig.java:60 — Changing setAllowedOrigins(Arrays.asList("http://localhost:3003")) to setAllowedOriginPatterns(Arrays.asList("*")) combined with setAllowCredentials(true) is a security risk. This allows any origin to make credentialed cross-origin requests to the dashboard API. In a production deployment, this could enable CSRF-like attacks. Consider:

  • Making the allowed origins configurable via application.yml (e.g., rocketmq.dashboard.allowed-origins)
  • Or at minimum restricting to the actual deployment domain pattern

• [Warning] remoteApi.js — Replacing new URL() + url.searchParams.append() with manual string concatenation (url += '?date=' + date) is a regression. The original URLSearchParams approach properly handles URL encoding of special characters. The new code does not encode parameters in queryBrokerHisData (line 831), which could break with date values containing special characters. The queryTopicHisData and queryBrokerConfig methods do use encodeURIComponent, but the inconsistency is concerning.

• [Info] remoteApi.js:19 — Changing apiBaseUrl from 'http://localhost:8082' to '' (empty/relative) is the correct fix for Docker deployments where the frontend and backend share the same host. This makes the API calls use the current page's origin.

Suggestions

1. Do not merge with allowedOriginPatterns("*") + allowCredentials(true). Make it configurable or restrict to specific patterns.
2. Restore URL + searchParams pattern for consistency, or at minimum apply encodeURIComponent uniformly to all query parameters.
3. Consider adding a dashboard.allowed-origins property in application.yml for deployment flexibility.

---

Automated review by github-manager-bot