oscerd opened a new pull request, #26430: URL: https://github.com/apache/camel/pull/26430
## What The `includeHeaders` wildcard no longer sends headers that carry a caller credential verbatim. ## Why `includeHeaders` defaults to `*`, so every message header went into the OPA `input` document — `Authorization`, `Proxy-Authorization`, `Cookie`, `Set-Cookie` included. OPA is trusted to make the decision; that is not the same as being an appropriate destination for every credential on the message. OPA's **decision logging** is a standard, commonly-enabled feature that ships the whole `input` document to a remote collector or to disk. With the old default, turning decision logs on silently exported every inbound `Authorization` header out of the JVM — not something the route makes visible. The body was already excluded by default (`includeBody=false`) on the grounds that it is usually unnecessary for an authorization decision, so the component already accepts this kind of asymmetry. ## What changed The wildcard now skips the four credential headers, matched case-insensitively (`authorization` is withheld too). **Naming a header explicitly is the opt-in** — `includeHeaders=Authorization,user` still sends it. The existing allow-list is the escape hatch, so no new option was added for this. This is option 2 of the three the issue laid out. Option 3 (empty default) would have been safest but leaves the component useless out of the box; option 1 (documentation only) does not change what a decision log captures. Narrowing the wildcard keeps the default usable while making the credential case deliberate. The docs now also point at `includeProperties` (CAMEL-24643) as the better channel for identity: a subject that an earlier authentication step has already *verified*, rather than a raw credential handed to the policy to re-check. ## Testing Three new cases in `OpaInputDocumentTest` (18 total): - the wildcard withholds `Authorization`, `Cookie` and `Proxy-Authorization` - withholding is case-insensitive - a credential header named explicitly is still sent All three were confirmed to **fail with the change reverted**, then pass with it restored. Full reactor build green, with the catalog JSON, the catalog copy of the `.adoc` and both DSL mirrors regenerated. `main` only. 4.23.0 has not shipped, so no released behaviour changes and no upgrade-guide entry is needed. _Claude Code on behalf of @oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
