jamesnetherton opened a new issue, #9106: URL: https://github.com/apache/camel-quarkus/issues/9106
`vertx-websocket` consumers are mounted on the shared Quarkus HTTP router, so they sit behind whatever authentication the application configures. Upstream `VertxWebsocketHost.connect()` only installs a `CorsHandler` when the route author sets `allowedOriginPattern`, so by default nothing checks the `Origin` header on the WebSocket upgrade request. None of this is documented. There are two ways to restrict the origins that consumers accept, and the usage guide should cover both: - `quarkus.http.cors.enabled = true`, which runs ahead of the Camel WebSocket route and rejects non same-origin upgrades with a `403` - the `allowedOriginPattern` endpoint option, for an individual consumer -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
