oscerd commented on code in PR #27819:
URL: https://github.com/apache/camel/pull/27819#discussion_r4269147962
##########
components/camel-graphql/src/main/java/org/apache/camel/component/graphql/GraphqlEndpoint.java:
##########
@@ -152,19 +155,69 @@ public void configureHttpClient(HttpClientBuilder
httpClientBuilder) {
if (jwtAuthorizationType != null) {
authType = jwtAuthorizationType;
}
- httpClientBuilder.setDefaultHeaders(
- Arrays.asList(new
BasicHeader(HttpHeaders.AUTHORIZATION, authType + " " + accessToken)));
+ Header authorization = new
BasicHeader(HttpHeaders.AUTHORIZATION, authType + " " + accessToken);
+ // added per request, and only for the authority of httpUri,
as camel-http does for its own
+ // credentials (CAMEL-24452): a default header would go with
every request the client executes
+ httpClientBuilder.addRequestInterceptorLast((request, entity,
context) -> {
+ if (!request.containsHeader(HttpHeaders.AUTHORIZATION) &&
isHttpUriAuthority(request)) {
+ request.addHeader(authorization);
+ }
+ });
}
- if (username != null && password != null) {
+ URIAuthority authority = httpUriAuthority();
Review Comment:
Done in 052a368c3d79. `configureHttpClient` now reads the scheme, host and
effective port of `httpUri` once, and the token check and the `AuthScope` both
use those values (the matcher is now a static `isAuthority(request, scheme,
host, port)`).
When an access token or a username/password is configured but that authority
cannot be read, it logs a warning with the sanitized endpoint URI and sends no
credentials. I went with a warning rather than an exception: for an
`http`/`https` URI without a readable host, camel-http already rejects the
request with "Invalid url".
_Claude Code on behalf of oscerd_
##########
docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc:
##########
@@ -312,6 +312,18 @@ A shard created by a split or a merge while the consumer
is running is now read
`iteratorType`. Previously, with `LATEST`, the records stored in the new shard
before the consumer listed it were
skipped. The shards that exist when the consumer starts are read from the
configured `iteratorType`, as before.
+=== camel-graphql - the credentials are only sent to the authority of httpUri
+
+The `accessToken` (with its `jwtAuthorizationType`) is now added to a request
only when the request goes to the
+scheme, host and port of `httpUri`, and the `username` and `password` are
registered for that authority only.
+Previously neither was bound to the authority of `httpUri`. A request to
another authority, including the same host
+with another scheme or port, is now sent without them. A route that needs to
authenticate to another authority must
+address it in `httpUri`.
Review Comment:
Applied in 052a368c3d79, thanks. Yes, that is intended: `username` and
`password` are the GraphQL server's credentials.
_Claude Code on behalf of oscerd_
##########
docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc:
##########
@@ -312,6 +312,18 @@ A shard created by a split or a merge while the consumer
is running is now read
`iteratorType`. Previously, with `LATEST`, the records stored in the new shard
before the consumer listed it were
skipped. The shards that exist when the consumer starts are read from the
configured `iteratorType`, as before.
+=== camel-graphql - the credentials are only sent to the authority of httpUri
+
+The `accessToken` (with its `jwtAuthorizationType`) is now added to a request
only when the request goes to the
+scheme, host and port of `httpUri`, and the `username` and `password` are
registered for that authority only.
+Previously neither was bound to the authority of `httpUri`. A request to
another authority, including the same host
+with another scheme or port, is now sent without them. A route that needs to
authenticate to another authority must
+address it in `httpUri`.
+
+The producer also no longer takes the request URL from the `CamelHttpUri`,
`CamelHttpPath`, `CamelHttpQuery` and other
+camel-http control headers of the message. It did so since Camel 4.19, when
the component moved onto camel-http; the
+request now always goes to `httpUri`, as it did before.
Review Comment:
Applied in 052a368c3d79. I kept the `CamelHttpMethod` line in `process()`
with a comment saying that camel-http does not read it and that the
`httpMethod` option of the internal endpoint decides, so the headers copied
back to the message stay the same.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
