oscerd opened a new pull request, #25821: URL: https://github.com/apache/camel/pull/25821
Fixes [CAMEL-24437](https://issues.apache.org/jira/browse/CAMEL-24437). buildCodeFlowAuthRequestUrl() sent only a redirect URI and scopes - no state - and OAuthCodeFlowCallback redeemed whatever code arrived and bound the resulting profile to the caller's session. Nothing tied the callback to a flow that session had started, which is the login CSRF that RFC 6749 section 10.12 and OpenID Connect Core require the state binding to prevent. OAuthCodeFlowParams already carried a state field; no processor set it. The hardcoded SameSite=None; Secure session cookie makes it reachable cross-site. OAuthCodeFlowProcessor now generates a 32-byte random state, stores it in the OAuth session, and passes it through both URL builders - VertxOAuth via OAuth2AuthorizationURL.setState, ServletOAuth as a state query parameter. OAuthCodeFlowCallback removes the stored value, so it is single use, and compares it with the callback's state using MessageDigest.isEqual. A callback with no flow in progress, or with a state that does not match, is answered with 400 and stops the route. Scope: state only. nonce needs ID-token validation to be worth sending, PKCE needs a code_verifier carried through AuthCodeCredentials and both authenticate() implementations, and the session cookie's SameSite is a separate change - all three are noted on the issue. Not verified end to end: OAuthCodeFlowVertxTest and OAuthCodeFlowServletTest are gated on an externally running Keycloak at https://oauth.localtest.me/kc, provisioned by the module's Helm chart, and were skipped here. They are what would confirm the provider echoes state back as a state message header. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> \n## Verification\n\n7 files changed, including 1 test file(s). Module build with \`-am\` is green on current main, no generated-file drift. Verified against the pre-fix code when the change was written. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
