This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new dc990927b60e CAMEL-26068: camel-netty-http - Ensure
NettyHttpSecurityConfiguration is copied per endpoint (#28351)
dc990927b60e is described below
commit dc990927b60e2b386a554d76ee497ea5057afef7
Author: Andrea Cosentino <[email protected]>
AuthorDate: Fri Oct 23 19:22:07 2026 +0200
CAMEL-26068: camel-netty-http - Ensure NettyHttpSecurityConfiguration is
copied per endpoint (#28351)
* CAMEL-26068: camel-netty-http - Ensure NettyHttpSecurityConfiguration is
copied per endpoint
Signed-off-by: Andrea Cosentino <[email protected]>
* CAMEL-26068: camel-netty-http - document that copy() is a shallow copy
Signed-off-by: Claus Ibsen <[email protected]>
---------
Signed-off-by: Andrea Cosentino <[email protected]>
Signed-off-by: Claus Ibsen <[email protected]>
Co-authored-by: Claus Ibsen <[email protected]>
---
.../component/netty/http/NettyHttpComponent.java | 6 +-
.../netty/http/NettyHttpSecurityConfiguration.java | 16 ++-
.../NettyHttpSharedSecurityConfigurationTest.java | 116 +++++++++++++++++++++
.../ROOT/pages/camel-4x-upgrade-guide-4_24.adoc | 4 +
4 files changed, 138 insertions(+), 4 deletions(-)
diff --git
a/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpComponent.java
b/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpComponent.java
index e6c6e9e5613c..2c5a72e7e7d7 100644
---
a/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpComponent.java
+++
b/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpComponent.java
@@ -207,9 +207,9 @@ public class NettyHttpComponent extends NettyComponent
}
if (securityConfiguration != null) {
- answer.setSecurityConfiguration(securityConfiguration);
- } else if (answer.getSecurityConfiguration() == null) {
- answer.setSecurityConfiguration(getSecurityConfiguration());
+ answer.setSecurityConfiguration(securityConfiguration.copy());
+ } else if (answer.getSecurityConfiguration() == null &&
getSecurityConfiguration() != null) {
+ answer.setSecurityConfiguration(getSecurityConfiguration().copy());
}
// configure any security options
diff --git
a/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpSecurityConfiguration.java
b/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpSecurityConfiguration.java
index 992228ff9eff..1e69ad93766d 100644
---
a/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpSecurityConfiguration.java
+++
b/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpSecurityConfiguration.java
@@ -17,12 +17,13 @@
package org.apache.camel.component.netty.http;
import org.apache.camel.LoggingLevel;
+import org.apache.camel.RuntimeCamelException;
import org.apache.camel.spi.Metadata;
/**
* Security configuration for the {@link NettyHttpConsumer}.
*/
-public class NettyHttpSecurityConfiguration {
+public class NettyHttpSecurityConfiguration implements Cloneable {
@Metadata(label = "security", defaultValue = "true", description =
"Whether to enable authentication")
private boolean authenticate = true;
@@ -113,4 +114,17 @@ public class NettyHttpSecurityConfiguration {
this.loginDeniedLoggingLevel = loginDeniedLoggingLevel;
}
+ /**
+ * Creates a shallow copy of this configuration, so an endpoint can change
its own options without affecting the
+ * component or other endpoints. The {@link SecurityConstraint} and {@link
SecurityAuthenticator} instances are
+ * shared with the original.
+ */
+ public NettyHttpSecurityConfiguration copy() {
+ try {
+ return (NettyHttpSecurityConfiguration) clone();
+ } catch (CloneNotSupportedException e) {
+ throw new RuntimeCamelException(e);
+ }
+ }
+
}
diff --git
a/components/camel-netty-http/src/test/java/org/apache/camel/component/netty/http/NettyHttpSharedSecurityConfigurationTest.java
b/components/camel-netty-http/src/test/java/org/apache/camel/component/netty/http/NettyHttpSharedSecurityConfigurationTest.java
new file mode 100644
index 000000000000..8464090fa0fb
--- /dev/null
+++
b/components/camel-netty-http/src/test/java/org/apache/camel/component/netty/http/NettyHttpSharedSecurityConfigurationTest.java
@@ -0,0 +1,116 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.netty.http;
+
+import org.apache.camel.CamelContext;
+import org.apache.camel.CamelExecutionException;
+import org.apache.camel.builder.RouteBuilder;
+import org.junit.jupiter.api.Test;
+
+import static org.apache.camel.test.junit6.TestSupport.assertIsInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class NettyHttpSharedSecurityConfigurationTest extends BaseNettyTestSupport {
+
+ @Override
+ public void doPreSetup() {
+ System.setProperty("java.security.auth.login.config",
"src/test/resources/myjaas.config");
+ }
+
+ @Override
+ public void doPostTearDown() {
+ System.clearProperty("java.security.auth.login.config");
+ }
+
+ @Override
+ protected CamelContext createCamelContext() throws Exception {
+ CamelContext context = super.createCamelContext();
+ NettyHttpComponent component = context.getComponent("netty-http",
NettyHttpComponent.class);
+
+ NettyHttpSecurityConfiguration security = new
NettyHttpSecurityConfiguration();
+ security.setRealm("karaf");
+ security.setAuthenticate(true);
+ SecurityAuthenticator auth = new JAASSecurityAuthenticator();
+ auth.setName("karaf");
+ security.setSecurityAuthenticator(auth);
+
+ component.setSecurityConfiguration(security);
+ return context;
+ }
+
+ @Test
+ void testSecurityConfigurationCopiedPerEndpoint() {
+ NettyHttpComponent component = context.getComponent("netty-http",
NettyHttpComponent.class);
+ NettyHttpEndpoint adminEndpoint =
context.getEndpoint("netty-http:http://0.0.0.0:"; + getPort() + "/admin",
+ NettyHttpEndpoint.class);
+ NettyHttpEndpoint publicEndpoint = context.getEndpoint(
+ "netty-http:http://0.0.0.0:"; + getPort() +
"/public?securityConfiguration.authenticate=false",
+ NettyHttpEndpoint.class);
+
+ // Component security configuration must remain authenticate = true
+ assertTrue(component.getSecurityConfiguration().isAuthenticate());
+
+ // Admin endpoint must remain authenticate = true
+ assertTrue(adminEndpoint.getSecurityConfiguration().isAuthenticate());
+
+ // Public endpoint must have authenticate = false
+
assertFalse(publicEndpoint.getSecurityConfiguration().isAuthenticate());
+
+ // Endpoints must have distinct configuration instances
+ assertNotSame(component.getSecurityConfiguration(),
adminEndpoint.getSecurityConfiguration());
+ assertNotSame(component.getSecurityConfiguration(),
publicEndpoint.getSecurityConfiguration());
+ assertNotSame(adminEndpoint.getSecurityConfiguration(),
publicEndpoint.getSecurityConfiguration());
+ }
+
+ @Test
+ void testAuthenticationEnforcement() {
+ // Unauthenticated request to admin route should fail with 401
+ CamelExecutionException e = assertThrows(CamelExecutionException.class,
+ () ->
template.requestBody("netty-http:http://localhost:{{port}}/admin";, "Hello
Admin", String.class));
+ NettyHttpOperationFailedException cause =
assertIsInstanceOf(NettyHttpOperationFailedException.class, e.getCause());
+ assertEquals(401, cause.getStatusCode());
+
+ // Authenticated request to admin route should succeed
+ String auth = "Basic c2NvdHQ6c2VjcmV0";
+ String adminResponse =
template.requestBodyAndHeader("netty-http:http://localhost:{{port}}/admin";,
"Hello Admin",
+ "Authorization", auth, String.class);
+ assertEquals("Admin OK", adminResponse);
+
+ // Unauthenticated request to public route should succeed
+ String publicResponse
+ =
template.requestBody("netty-http:http://localhost:{{port}}/public";, "Hello
Public", String.class);
+ assertEquals("Public OK", publicResponse);
+ }
+
+ @Override
+ protected RouteBuilder createRouteBuilder() {
+ return new RouteBuilder() {
+ @Override
+ public void configure() {
+ from("netty-http:http://0.0.0.0:{{port}}/admin";)
+ .transform().constant("Admin OK");
+
+
from("netty-http:http://0.0.0.0:{{port}}/public?securityConfiguration.authenticate=false";)
+ .transform().constant("Public OK");
+ }
+ };
+ }
+}
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
index b213826e71a7..ceb34e9b5906 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
@@ -1989,6 +1989,10 @@ threw an `IndexOutOfBoundsException` at the end.
`markSupported()` now returns `
anything): a reader that needs mark support has to wrap the stream, for
example in a `BufferedInputStream`.
`reset()` goes back to the start of the body, as before.
+=== camel-netty-http - securityConfiguration is copied per endpoint
+
+When `securityConfiguration` is set on the `NettyHttpComponent`, each endpoint
now receives an independent copy of the configuration. Modifying
`securityConfiguration.*` options on an endpoint URI no longer alters the
component-level configuration or other endpoints.
+
=== camel-netty - hostnameVerification verifies the host instead of failing
`hostnameVerification=true` on a `netty` producer, or on a consumer with
`clientMode=true`, now checks that the
