oscerd commented on PR #25187: URL: https://github.com/apache/camel/pull/25187#issuecomment-5104579500
Two follow-up notes on the review round, beyond the three inline replies. **On `insecure:dev`:** applied to both properties classes as suggested, and it propagates correctly into the generated metadata for `camel.server.jwtAllowMissingIssuerAndAudience` and `camel.management.jwtAllowMissingIssuerAndAudience`. Worth flagging though that `design/security.adoc` defines `insecure:dev` as *"development/debug features that should not be enabled in production"* (`devConsoleEnabled`, `debugBreakpoints`), whereas this flag weakens **authentication** rather than enabling a dev feature. None of the three valid values (`insecure:ssl`, `insecure:serialization`, `insecure:dev`) really covers auth-weakening options. `insecure:dev` is the closest fit and matches what this file already does, so it is what I used, but a dedicated `insecure:auth` category may be the better long-term answer. That would be a separate change across the annotation, the docs and `SecurityUtils` generation, so I have not attempted it here. **Re-verified against the Vert.x upgrade:** `main` moved from Vert.x 4.5.28 to 4.5.31 while this PR was open. Since the change depends on how Vert.x applies `JWTOptions` claim checks, I merged `main` and re-ran rather than assuming: module suite is green (23 tests) on 4.5.31, behaviour unchanged. The merge also resolved a conflict in `camel-4x-upgrade-guide-4_22.adoc` against the CAMEL-24279 entry that landed in the meantime; both notes are kept. Full reactor build `mvn clean install -DskipTests` green, no regenerated-file drift. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
