This is an automated email from the ASF dual-hosted git repository.
Croway pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 126c79bdf3f1 CAMEL-24453: camel-platform-http - compare request header
names case-insensitively when suppressing the echo (#25831)
126c79bdf3f1 is described below
commit 126c79bdf3f171184461f987c143b5a818df4d81
Author: Andrea Cosentino <[email protected]>
AuthorDate: Fri Aug 28 11:32:18 2026 +0200
CAMEL-24453: camel-platform-http - compare request header names
case-insensitively when suppressing the echo (#25831)
enhanceHeaderFilterStrategyToSkipHttpRequestHeaders() keeps common request
headers -
Authorization, Cookie, Proxy-Authorization and the rest of
COMMON_HTTP_REQUEST_HEADERS -
from being echoed back on the response. The lookup was
Set.contains(headerName) against
a canonically capitalised Set.of(...), while exchange headers keep the
casing of the
inbound request: VertxPlatformHttpConsumer populates them from the Vert.x
MultiMap as
received.
HTTP/2 requires field names to be lower case, so on an HTTP/2 request the
names are
authorization, cookie and so on, none of which matched. The suppression
therefore never
fired for HTTP/2 traffic, nor for any client that varied the casing, and
VertxPlatformHttpSupport.copyMessageHeadersToResponse wrote the headers to
the response.
Hold the set in a TreeSet ordered by String.CASE_INSENSITIVE_ORDER so the
comparison no
longer depends on how the client spelled the name.
Signed-off-by: Andrea Cosentino <[email protected]>
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
Co-authored-by: Federico Mariani <[email protected]>
---
.../platform/http/PlatformHttpEndpoint.java | 16 ++++++-
.../http/PlatformHttpEndpointHeaderEchoTest.java | 53 ++++++++++++++++++++++
.../ROOT/pages/camel-4x-upgrade-guide-4_23.adoc | 10 ++++
3 files changed, 78 insertions(+), 1 deletion(-)
diff --git
a/components/camel-platform-http/src/main/java/org/apache/camel/component/platform/http/PlatformHttpEndpoint.java
b/components/camel-platform-http/src/main/java/org/apache/camel/component/platform/http/PlatformHttpEndpoint.java
index 01a57379a351..8574380b9d6e 100644
---
a/components/camel-platform-http/src/main/java/org/apache/camel/component/platform/http/PlatformHttpEndpoint.java
+++
b/components/camel-platform-http/src/main/java/org/apache/camel/component/platform/http/PlatformHttpEndpoint.java
@@ -16,7 +16,10 @@
*/
package org.apache.camel.component.platform.http;
+import java.util.Arrays;
+import java.util.Collections;
import java.util.Set;
+import java.util.TreeSet;
import org.apache.camel.AsyncEndpoint;
import org.apache.camel.Category;
@@ -53,7 +56,12 @@ public class PlatformHttpEndpoint extends DefaultEndpoint
private static final String PROXY_PATH = "proxy";
- private static final Set<String> COMMON_HTTP_REQUEST_HEADERS = Set.of(
+ /**
+ * Request headers that must not be echoed back on the response. Compared
without regard to case: exchange headers
+ * keep the casing of the inbound request, and HTTP/2 requires field names
to be lower case, so an exact-case lookup
+ * against these canonical spellings never matches an HTTP/2 request.
+ */
+ private static final Set<String> COMMON_HTTP_REQUEST_HEADERS =
caseInsensitiveSet(
"A-IM",
"Accept",
"Accept-Charset",
@@ -83,6 +91,12 @@ public class PlatformHttpEndpoint extends DefaultEndpoint
"TE",
"User-Agent");
+ private static Set<String> caseInsensitiveSet(String... names) {
+ Set<String> set = new TreeSet<>(String.CASE_INSENSITIVE_ORDER);
+ set.addAll(Arrays.asList(names));
+ return Collections.unmodifiableSet(set);
+ }
+
@UriPath(description = "The path under which this endpoint serves the HTTP
requests, for proxy use 'proxy'")
@Metadata(required = true)
private final String path;
diff --git
a/components/camel-platform-http/src/test/java/org/apache/camel/component/platform/http/PlatformHttpEndpointHeaderEchoTest.java
b/components/camel-platform-http/src/test/java/org/apache/camel/component/platform/http/PlatformHttpEndpointHeaderEchoTest.java
new file mode 100644
index 000000000000..b428d6209836
--- /dev/null
+++
b/components/camel-platform-http/src/test/java/org/apache/camel/component/platform/http/PlatformHttpEndpointHeaderEchoTest.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.platform.http;
+
+import org.apache.camel.impl.DefaultCamelContext;
+import org.apache.camel.spi.HeaderFilterStrategy;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * Exchange headers keep the casing of the inbound request, and HTTP/2
requires field names to be lower case. An
+ * exact-case lookup against canonically capitalised names therefore never
suppresses anything on an HTTP/2 request,
+ * which is the traffic most likely to carry the credentials this is meant to
keep out of the response.
+ */
+class PlatformHttpEndpointHeaderEchoTest {
+
+ @Test
+ void requestHeadersAreSuppressedWhateverTheirCasing() throws Exception {
+ try (DefaultCamelContext context = new DefaultCamelContext()) {
+ context.start();
+ PlatformHttpComponent component = new
PlatformHttpComponent(context);
+ PlatformHttpEndpoint endpoint
+ = (PlatformHttpEndpoint)
component.createEndpoint("platform-http:/test");
+
+ HeaderFilterStrategy strategy = endpoint.getHeaderFilterStrategy();
+
+ // canonical, as sent over HTTP/1.1
+ assertTrue(strategy.applyFilterToCamelHeaders("Authorization",
"Bearer x", null));
+ assertTrue(strategy.applyFilterToCamelHeaders("Cookie", "a=b",
null));
+ // lower case, as required by HTTP/2
+ assertTrue(strategy.applyFilterToCamelHeaders("authorization",
"Bearer x", null));
+ assertTrue(strategy.applyFilterToCamelHeaders("cookie", "a=b",
null));
+
assertTrue(strategy.applyFilterToCamelHeaders("proxy-authorization", "Basic x",
null));
+ // and any other casing a client might send
+ assertTrue(strategy.applyFilterToCamelHeaders("AUTHORIZATION",
"Bearer x", null));
+ }
+ }
+}
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
index 7e69416ee60c..bf7a63b6a087 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
@@ -577,6 +577,16 @@ this can never turn an endpoint into a proxy that was not
already one.
Routes relying on the prefix match must be renamed to the exact path `proxy`.
+`PlatformHttpEndpoint` wraps the endpoint's `HeaderFilterStrategy` so that
common request headers —
+`Authorization`, `Cookie`, `Proxy-Authorization` and the rest of
`COMMON_HTTP_REQUEST_HEADERS` — are not
+echoed back on the response. The lookup compared names exactly against that
canonically capitalised set,
+while exchange headers keep the casing of the inbound request. HTTP/2 requires
field names to be lower
+case, so on an HTTP/2 request the names are `authorization`, `cookie` and so
on, none of which matched:
+the suppression never fired for HTTP/2 traffic, or for any client that varied
the casing.
+
+Names are now compared case-insensitively. Responses that previously echoed
these headers back on HTTP/2
+requests no longer do.
+
=== camel-grpc
The gRPC consumer no longer returns the route exception's message to the
client.
