Aias00 commented on issue #6397:
URL: https://github.com/apache/shenyu/issues/6397#issuecomment-5161700199
Reopening — the fix was not applied. The login endpoint is still mapped as
GET on master:
`shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/PlatformController.java:58`
→ `@GetMapping("/login")` with `userName`/`password` taken as query-style
params. Credentials therefore continue to land in access logs, browser history,
and `Referer` headers.
Verified during the 2026-08-02 security re-audit (independent verification
gate). The issue was closed as COMPLETED today but the code on master does not
reflect a GET→POST change. Reopening to track the actual fix; please switch to
`@PostMapping` (and read credentials from the request body) before closing
again.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
