/debug/pprof/ this api un auth

[liangliang4ward]

Issue description

/debug/pprof/ 未登录的情况下可以直接访问

Expected behavior

/debug/pprof/ 未登录不能访问

How to Reproduce

curl localhost:9000/debug/pprof/

Screenshots

No response

Environment

• apisix version (cmd: apisix version):
• OS (cmd: uname -a):
• OpenResty / Nginx version (cmd: nginx -V or openresty -V):
• etcd version, if have (cmd: run etcd --version):
• apisix-dashboard version, if have: 2.10
• Browser version, if have:

Additional context

No response

[zaunist]

@qq54903099 Thansk for your comment, we will check it.

[jwrookie]

ref :

apisix-dashboard/api/internal/filter/authentication.go

Lines 30 to 37 in 131601d

	func Authentication() gin.HandlerFunc {
	return func(c *gin.Context) {
	if c.Request.URL.Path == "/apisix/admin/user/login" ||
	c.Request.URL.Path == "/apisix/admin/tool/version" ||
	!strings.HasPrefix(c.Request.URL.Path, "/apisix") {
	c.Next()
	return
	}

path : /debug/pprof omited the auth check, by design?

I'd be happy to fix it if you want

[zaunist]

@jwrookie You are right! Welcome to pr.

[jwrookie]

can i base on cookie to fast fix it?

[zaunist]

I'm not sure how do you want to do, can you give some example ？

[jwrookie]

currently, user authentication is done through http headers, can not auto add the headers on a newtab for /debug/pprof

[zaunist]

Got it.

[zaunist]

@jwrookie . You can submit a PR to accomplish your idea, and other community member will review your code.

[jwrookie]

droplet nonsupport set cookie 😥

[bzp2010]

Maybe we can add a configuration item that is turned off by default, I don't think the pforf API is very meaningful for dashboard. I.e., turn off this API by default and turn it on by modifying the configuration when you need to use it.

[jwrookie]

but at turn it on, the problem will reproduce

[zaunist]

Hi, community. IMO, since this interface is very rarely used, I suggest removing pprof and adding one manually for debugging if needed in development.

[zaunist]

And I'm glad to contribute this issue.

[jwrookie]

If it is not connected to prometheus or other similar tools, I recommend using it for continuous monitoring and analysis