oscerd opened a new pull request, #25829: URL: https://github.com/apache/camel/pull/25829
Fixes [CAMEL-24450](https://issues.apache.org/jira/browse/CAMEL-24450). enableCORS=true added new CrossOriginFilter() with no init parameters, so Jetty's own defaults applied. Confirmed against jetty-ee10-servlets 12.1.12: DEFAULT_ALLOWED_ORIGINS is "*" and credentials default to true. The filter reflects the request's origin rather than sending "*", so that pairing is the credentialed any-origin configuration the fetch specification refuses to express - reflecting the origin being the usual way around that rule. An option named "enable CORS" should not mean "every origin, with credentials". Default allowCredentials to false when CORS is enabled. The origin is still reflected, so enabling CORS keeps working for requests that carry no credentials; an operator who needs credentialed cross-origin requests sets filterInit.allowCredentials=true and names the origins in filterInit.allowedOrigins. Asking for credentials while leaving the origins at "*" is logged as a warning, since that combination reproduces the original behaviour. The defaults are applied where the init parameter map is built, not where the filter is added: the map is handed to the endpoint earlier and only when it is non-empty, so applying them later would drop them in exactly the case that matters - enableCORS on its own, with no filterInit parameters at all. EnableCORSTest.testCORSenabled asserted that credentials are granted, so it encoded the previous behaviour; it now asserts the opposite, and a second test covers the opt-in. Matches the change made to camel-platform-http-vertx under CAMEL-24436. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> \n## Verification\n\n3 files changed, including 1 test file(s). Module build with \`-am\` is green on current main, no generated-file drift. Verified against the pre-fix code when the change was written. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
