allthingssecurity opened a new pull request, #27589: URL: https://github.com/apache/camel/pull/27589
# Description [CAMEL-22080](https://issues.apache.org/jira/browse/CAMEL-22080) Reported by Mikael Andersson Wigander. With `oauth2CacheTokens=true`, camel-http keys its token cache on the full request URI. Requests to `https://host/event/1` and `https://host/event/2`, or to `https://host/event?eventId=1` and `?eventId=2`, each request a new token from the token endpoint. The static cache also keeps one entry per URI, so with dynamic paths or queries it grows with every new URI. The token request (`grant_type=client_credentials` with client id/secret, scope and resource indicator) does not include the request URI, so all these requests get equivalent tokens. This follows the design Claus suggested on the ticket (2025-05-20): make the key configurable, add an API for custom logic, and have a default implementation with the three strategies Mikael listed. The default stays as it is; sharing tokens more widely is opt-in: - `OAuth2CachedTokensKeyResolver` (new public functional interface): `String resolveKey(URI requestUri)`. Requests with equal keys share a cached token. Returning `null` means the token is not cached for that request. The client id, client secret, token endpoint, scope and resource indicator are always part of the cache key, whatever the resolver returns, so the scope isolation added for the static cache is unchanged. - `OAuth2CachedTokensKey` (new enum, implements the interface), the default implementation: `FULL_URI` (the request URI, the default and the current behaviour), `HOST_AND_PATH` (scheme, host, port and raw path, no query) and `HOST_ONLY` (scheme, host and port, with default ports and case normalized). - Two new endpoint options on the http/https endpoint, next to the other `oauth2CachedTokens*` options: `oauth2CachedTokensKey` (default `FULL_URI`) and `oauth2CachedTokensKeyResolver` (advanced, a bean reference or instance, takes precedence). They are read in `HttpComponent.configureOAuth2Authentication` like the other OAuth2 options and are also set on the endpoint. The options are on camel-http's `HttpEndpoint`, not on `HttpCommonEndpoint`, because only camel-http implements OAuth2. The public `OAuth2ClientConfigurer` constructor keeps its signature and uses `FULL_URI`. No behaviour change for existing routes: the default is `FULL_URI`, so tokens are cached per request URI as before. Users who want fewer token requests set `oauth2CachedTokensKey=HOST_AND_PATH` or `HOST_ONLY` (the ticket proposed `HOST_ONLY` as the new default; keeping the old default avoids sharing a token across paths for users who did not ask for it). Also not changed: `oauth2CacheTokens` stays `false` by default (the reporter's other suggestion), and the expiry handling. As nothing changes on upgrade, there is no upgrade guide entry. Docs: a "Caching tokens" section in the OAuth2 part of the http component page (the three strategies, a `toD` example with `HOST_ONLY` in Java/XML/YAML tabs, and the custom resolver). Regenerated: the http/https JSON, configurer and URI factory, the catalog copies and `HttpEndpointBuilderFactory`. Tests: - `HttpOAuth2TokenCachingTest`: six new tests for a second request with a different query, a different path or a different `CamelHttpPath` header (the token endpoint is closed after the first request, like the existing tests there). With the default, each of them requests a new token (`HttpHostConnectException` from the closed token endpoint), which guards the unchanged default (these three also pass on main). With `oauth2CachedTokensKey=HOST_ONLY`, each of them reuses the cached token. - `HttpOAuth2CachedTokensKeyTest`: `HOST_AND_PATH` and explicit `FULL_URI`, a custom resolver bound in the registry (takes precedence; `null` means no caching), and the endpoint options (default `FULL_URI`). - `OAuth2CachedTokensKeyTest`: the keys of the three strategies. - camel-http module: 275 tests, 0 failures, 9 skipped (OAuth2 classes: `HttpOAuth2TokenCachingTest` 12, `HttpOAuth2CachedTokensKeyTest` 7, `OAuth2CachedTokensKeyTest` 3, `HttpOAuth2RedirectTokenLeakTest` 4, `HttpOAuth2AuthenticationTest` 3, `HttpOAuth2ScopeTest` 1). Related classes in other modules (camel-jetty `HttpBasicAuthComponentConfiguredTest`, `HttpBridgeMultipartRouteTest`, `MultiThreadedHttpGetTest`, `HttpJavaBodyTest`, `RestJettyRedirectTest`, camel-kamelet `KameletGlobalPropertiesTest`) passed on the earlier revision; this revision only changes the default value. # Target - [x] I checked that the commit is targeting the correct branch (Camel 4 uses the `main` branch) # Tracking - [x] If this is a large change, bug fix, or code improvement, I checked there is a [JIRA issue](https://issues.apache.org/jira/browse/CAMEL) filed for the change (usually before you start working on it). # Apache Camel coding standards and style - [x] I checked that each commit in the pull request has a meaningful subject line and body. - [ ] I have run `mvn clean install -DskipTests` locally from root folder and I have committed all auto-generated changes. (I built and tested camel-http with the formatter and import-sort plugins, copied its JSON and docs to the catalog, and regenerated the endpoint DSL with the `generate-endpoint-dsl` generator. Only `HttpEndpointBuilderFactory` changed. I did not run the full root build.) # AI-assisted contributions - [x] If this PR includes AI-generated code, commits have proper co-authorship attribution (e.g., `Co-authored-by` trailers) and the PR description identifies the AI tool used. This PR was prepared with Claude Code (Claude Opus 5.5). The commit carries a `Co-Authored-By` trailer. _Claude Code on behalf of allthingssecurity_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
