This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch camel-4.22.x
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/camel-4.22.x by this push:
new 6ffa8e5c664f [backport camel-4.22.x] CAMEL-26068: camel-netty-http -
Ensure NettyHttpSecurityConfiguration is copied per endpoint (#28366)
6ffa8e5c664f is described below
commit 6ffa8e5c664f17b6d6d4fe1dfdc3a81784b95eee
Author: Guillaume Nodet <[email protected]>
AuthorDate: Sat Oct 24 15:58:46 2026 +0200
[backport camel-4.22.x] CAMEL-26068: camel-netty-http - Ensure
NettyHttpSecurityConfiguration is copied per endpoint (#28366)
Cherry-pick of dc990927b60e from main; conflicts resolved automatically by
a backport bot agent (AI).
Co-authored-by: Claus Ibsen <[email protected]>
---
.../component/netty/http/NettyHttpComponent.java | 6 +-
.../netty/http/NettyHttpSecurityConfiguration.java | 16 ++-
.../NettyHttpSharedSecurityConfigurationTest.java | 116 +++++++++++++++++++++
.../ROOT/pages/camel-4x-upgrade-guide-4_22.adoc | 4 +
4 files changed, 138 insertions(+), 4 deletions(-)
diff --git
a/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpComponent.java
b/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpComponent.java
index f1880c54a303..9070c291c568 100644
---
a/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpComponent.java
+++
b/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpComponent.java
@@ -209,9 +209,9 @@ public class NettyHttpComponent extends NettyComponent
}
if (securityConfiguration != null) {
- answer.setSecurityConfiguration(securityConfiguration);
- } else if (answer.getSecurityConfiguration() == null) {
- answer.setSecurityConfiguration(getSecurityConfiguration());
+ answer.setSecurityConfiguration(securityConfiguration.copy());
+ } else if (answer.getSecurityConfiguration() == null &&
getSecurityConfiguration() != null) {
+ answer.setSecurityConfiguration(getSecurityConfiguration().copy());
}
// configure any security options
diff --git
a/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpSecurityConfiguration.java
b/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpSecurityConfiguration.java
index 992228ff9eff..1e69ad93766d 100644
---
a/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpSecurityConfiguration.java
+++
b/components/camel-netty-http/src/main/java/org/apache/camel/component/netty/http/NettyHttpSecurityConfiguration.java
@@ -17,12 +17,13 @@
package org.apache.camel.component.netty.http;
import org.apache.camel.LoggingLevel;
+import org.apache.camel.RuntimeCamelException;
import org.apache.camel.spi.Metadata;
/**
* Security configuration for the {@link NettyHttpConsumer}.
*/
-public class NettyHttpSecurityConfiguration {
+public class NettyHttpSecurityConfiguration implements Cloneable {
@Metadata(label = "security", defaultValue = "true", description =
"Whether to enable authentication")
private boolean authenticate = true;
@@ -113,4 +114,17 @@ public class NettyHttpSecurityConfiguration {
this.loginDeniedLoggingLevel = loginDeniedLoggingLevel;
}
+ /**
+ * Creates a shallow copy of this configuration, so an endpoint can change
its own options without affecting the
+ * component or other endpoints. The {@link SecurityConstraint} and {@link
SecurityAuthenticator} instances are
+ * shared with the original.
+ */
+ public NettyHttpSecurityConfiguration copy() {
+ try {
+ return (NettyHttpSecurityConfiguration) clone();
+ } catch (CloneNotSupportedException e) {
+ throw new RuntimeCamelException(e);
+ }
+ }
+
}
diff --git
a/components/camel-netty-http/src/test/java/org/apache/camel/component/netty/http/NettyHttpSharedSecurityConfigurationTest.java
b/components/camel-netty-http/src/test/java/org/apache/camel/component/netty/http/NettyHttpSharedSecurityConfigurationTest.java
new file mode 100644
index 000000000000..8464090fa0fb
--- /dev/null
+++
b/components/camel-netty-http/src/test/java/org/apache/camel/component/netty/http/NettyHttpSharedSecurityConfigurationTest.java
@@ -0,0 +1,116 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.netty.http;
+
+import org.apache.camel.CamelContext;
+import org.apache.camel.CamelExecutionException;
+import org.apache.camel.builder.RouteBuilder;
+import org.junit.jupiter.api.Test;
+
+import static org.apache.camel.test.junit6.TestSupport.assertIsInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class NettyHttpSharedSecurityConfigurationTest extends BaseNettyTestSupport {
+
+ @Override
+ public void doPreSetup() {
+ System.setProperty("java.security.auth.login.config",
"src/test/resources/myjaas.config");
+ }
+
+ @Override
+ public void doPostTearDown() {
+ System.clearProperty("java.security.auth.login.config");
+ }
+
+ @Override
+ protected CamelContext createCamelContext() throws Exception {
+ CamelContext context = super.createCamelContext();
+ NettyHttpComponent component = context.getComponent("netty-http",
NettyHttpComponent.class);
+
+ NettyHttpSecurityConfiguration security = new
NettyHttpSecurityConfiguration();
+ security.setRealm("karaf");
+ security.setAuthenticate(true);
+ SecurityAuthenticator auth = new JAASSecurityAuthenticator();
+ auth.setName("karaf");
+ security.setSecurityAuthenticator(auth);
+
+ component.setSecurityConfiguration(security);
+ return context;
+ }
+
+ @Test
+ void testSecurityConfigurationCopiedPerEndpoint() {
+ NettyHttpComponent component = context.getComponent("netty-http",
NettyHttpComponent.class);
+ NettyHttpEndpoint adminEndpoint =
context.getEndpoint("netty-http:http://0.0.0.0:"; + getPort() + "/admin",
+ NettyHttpEndpoint.class);
+ NettyHttpEndpoint publicEndpoint = context.getEndpoint(
+ "netty-http:http://0.0.0.0:"; + getPort() +
"/public?securityConfiguration.authenticate=false",
+ NettyHttpEndpoint.class);
+
+ // Component security configuration must remain authenticate = true
+ assertTrue(component.getSecurityConfiguration().isAuthenticate());
+
+ // Admin endpoint must remain authenticate = true
+ assertTrue(adminEndpoint.getSecurityConfiguration().isAuthenticate());
+
+ // Public endpoint must have authenticate = false
+
assertFalse(publicEndpoint.getSecurityConfiguration().isAuthenticate());
+
+ // Endpoints must have distinct configuration instances
+ assertNotSame(component.getSecurityConfiguration(),
adminEndpoint.getSecurityConfiguration());
+ assertNotSame(component.getSecurityConfiguration(),
publicEndpoint.getSecurityConfiguration());
+ assertNotSame(adminEndpoint.getSecurityConfiguration(),
publicEndpoint.getSecurityConfiguration());
+ }
+
+ @Test
+ void testAuthenticationEnforcement() {
+ // Unauthenticated request to admin route should fail with 401
+ CamelExecutionException e = assertThrows(CamelExecutionException.class,
+ () ->
template.requestBody("netty-http:http://localhost:{{port}}/admin";, "Hello
Admin", String.class));
+ NettyHttpOperationFailedException cause =
assertIsInstanceOf(NettyHttpOperationFailedException.class, e.getCause());
+ assertEquals(401, cause.getStatusCode());
+
+ // Authenticated request to admin route should succeed
+ String auth = "Basic c2NvdHQ6c2VjcmV0";
+ String adminResponse =
template.requestBodyAndHeader("netty-http:http://localhost:{{port}}/admin";,
"Hello Admin",
+ "Authorization", auth, String.class);
+ assertEquals("Admin OK", adminResponse);
+
+ // Unauthenticated request to public route should succeed
+ String publicResponse
+ =
template.requestBody("netty-http:http://localhost:{{port}}/public";, "Hello
Public", String.class);
+ assertEquals("Public OK", publicResponse);
+ }
+
+ @Override
+ protected RouteBuilder createRouteBuilder() {
+ return new RouteBuilder() {
+ @Override
+ public void configure() {
+ from("netty-http:http://0.0.0.0:{{port}}/admin";)
+ .transform().constant("Admin OK");
+
+
from("netty-http:http://0.0.0.0:{{port}}/public?securityConfiguration.authenticate=false";)
+ .transform().constant("Public OK");
+ }
+ };
+ }
+}
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
index 2078c173f62a..800afc909c3f 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
@@ -2069,6 +2069,10 @@ so a downstream reader that expected that type received
an incompatible object.
A route that reads the full embeddings or audio response from
`CamelOpenAIResponse` must switch to the
matching property. The chat-completion and responses operations are unchanged.
+=== camel-netty-http - securityConfiguration is copied per endpoint
+
+When `securityConfiguration` is set on the `NettyHttpComponent`, each endpoint
now receives an independent copy of the configuration. Modifying
`securityConfiguration.*` options on an endpoint URI no longer alters the
component-level configuration or other endpoints.
+
=== camel-jta, camel-spring - a transacted exchange that completes during a
graceful shutdown is committed
Since Camel 4.19, a transacted exchange (JTA or Spring transacted routes) that
was in flight when a graceful shutdown
