oscerd opened a new pull request, #25937: URL: https://github.com/apache/camel/pull/25937
Backport to `camel-4.22.x` of four fixes already reviewed and merged on `main`. All four are about a credential or a CORS grant reaching a party the operator never named. - CAMEL-24456: camel-http - key the OAuth2 token cache on every field that shapes the token (#25834, `4e2ddabd`) - CAMEL-24450: camel-jetty - do not grant CORS credentials to an origin the operator did not name (#25829, `6e3e4ec5`) - CAMEL-24452: camel-http - do not send credentials to an authority the endpoint was not configured with (#25830, `3a6c27bf`) - CAMEL-24436: camel-platform-http-vertx - only allow CORS credentials for a configured origin (#25820, `4b557e4e`) Straight cherry-picks, applied in the order they merged on `main`, with no manual conflict resolution. The upgrade-guide entries are not included: the guides for every line live on `main`. **Behaviour changes to be aware of when upgrading a patch release:** - `enableCORS=true` on jetty no longer installs Jetty's allow-all `CrossOriginFilter` defaults. A deployment that relied on any origin being accepted must now name its origins. - platform-http-vertx sends `Access-Control-Allow-Credentials` only when the request origin matched a configured origin. With no origin list the origin is still reflected as before, but credentials are not granted, and `Vary: Origin` is now set. - camel-http stops re-attaching `Authorization` on cross-authority redirects when `followRedirects=true`. Built and tested per module on this branch (`camel-http`, `camel-jetty-common`, `camel-jetty`, `camel-platform-http-vertx`), including the new and touched tests: `HttpOAuth2TokenCachingTest`, `HttpOAuth2RedirectTokenLeakTest`, `HttpClientConfigurerOverrideTest`, `EnableCORSTest`, `VertxPlatformHttpEngineTest`. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
