davsclaus commented on code in PR #27819:
URL: https://github.com/apache/camel/pull/27819#discussion_r4269042907
##########
components/camel-graphql/src/main/java/org/apache/camel/component/graphql/GraphqlEndpoint.java:
##########
@@ -152,19 +155,69 @@ public void configureHttpClient(HttpClientBuilder
httpClientBuilder) {
if (jwtAuthorizationType != null) {
authType = jwtAuthorizationType;
}
- httpClientBuilder.setDefaultHeaders(
- Arrays.asList(new
BasicHeader(HttpHeaders.AUTHORIZATION, authType + " " + accessToken)));
+ Header authorization = new
BasicHeader(HttpHeaders.AUTHORIZATION, authType + " " + accessToken);
+ // added per request, and only for the authority of httpUri,
as camel-http does for its own
+ // credentials (CAMEL-24452): a default header would go with
every request the client executes
+ httpClientBuilder.addRequestInterceptorLast((request, entity,
context) -> {
+ if (!request.containsHeader(HttpHeaders.AUTHORIZATION) &&
isHttpUriAuthority(request)) {
+ request.addHeader(authorization);
+ }
+ });
}
- if (username != null && password != null) {
+ URIAuthority authority = httpUriAuthority();
Review Comment:
Minor: `isHttpUriAuthority` calls `httpUriAuthority()` again on every
request, and for a host with an underscore that parses
`URIAuthority.create(...)` each time. Computing the authority (and its
effective port) once at the top of `configureHttpClient`, and capturing it in
the interceptor lambda, would avoid that and make sure the token check and the
`AuthScope` use the same value.
Also, when `username`/`password` are set but the authority cannot be read,
the credentials are now dropped silently, where before they were used. That
should not happen for an `http`/`https` URI, but a `LOG.warn` (or an
`IllegalArgumentException`) would make the case visible.
##########
docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc:
##########
@@ -312,6 +312,18 @@ A shard created by a split or a merge while the consumer
is running is now read
`iteratorType`. Previously, with `LATEST`, the records stored in the new shard
before the consumer listed it were
skipped. The shards that exist when the consumer starts are read from the
configured `iteratorType`, as before.
+=== camel-graphql - the credentials are only sent to the authority of httpUri
+
+The `accessToken` (with its `jwtAuthorizationType`) is now added to a request
only when the request goes to the
+scheme, host and port of `httpUri`, and the `username` and `password` are
registered for that authority only.
+Previously neither was bound to the authority of `httpUri`. A request to
another authority, including the same host
+with another scheme or port, is now sent without them. A route that needs to
authenticate to another authority must
+address it in `httpUri`.
Review Comment:
If dropping the proxy case is intended (I think it is), maybe say so here:
```suggestion
address it in `httpUri`. When `proxyHost` is set, the `username` and
`password` are no longer offered to the proxy when it asks for authentication.
```
##########
docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc:
##########
@@ -312,6 +312,18 @@ A shard created by a split or a merge while the consumer
is running is now read
`iteratorType`. Previously, with `LATEST`, the records stored in the new shard
before the consumer listed it were
skipped. The shards that exist when the consumer starts are read from the
configured `iteratorType`, as before.
+=== camel-graphql - the credentials are only sent to the authority of httpUri
+
+The `accessToken` (with its `jwtAuthorizationType`) is now added to a request
only when the request goes to the
+scheme, host and port of `httpUri`, and the `username` and `password` are
registered for that authority only.
+Previously neither was bound to the authority of `httpUri`. A request to
another authority, including the same host
+with another scheme or port, is now sent without them. A route that needs to
authenticate to another authority must
+address it in `httpUri`.
+
+The producer also no longer takes the request URL from the `CamelHttpUri`,
`CamelHttpPath`, `CamelHttpQuery` and other
+camel-http control headers of the message. It did so since Camel 4.19, when
the component moved onto camel-http; the
+request now always goes to `httpUri`, as it did before.
Review Comment:
`skipControlHeaders=true` also covers the method and protocol version
headers:
```suggestion
request now always goes to `httpUri`, as it did before. For the same reason
the `CamelHttpMethod` and `CamelHttpProtocolVersion` headers no longer apply,
and the request is always a POST.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
