oscerd opened a new pull request, #28512: URL: https://github.com/apache/camel/pull/28512
Jira: https://issues.apache.org/jira/browse/CAMEL-26319 ### Problem In `InMemorySessionStore.createSession(Exchange)` (camel-oauth), the session identifier is logged at `INFO` level when creating a new session. In addition, during the OAuth authorization code flow, `OAuthCodeFlowCallback.process(Exchange)` binds the authenticated `UserProfile` to the pre-existing session without rotating the session identifier, allowing the pre-authentication identifier to remain valid and active post-login. ### Change - `OAuthSessionStore`: Added default `rotateSession(Exchange exchange, OAuthSession session)` method to support session identifier rotation. - `OAuth`: Added `rotateSession(Exchange exchange, OAuthSession session)` delegating to the session store. - `InMemorySession`: Added `getValues()` and `putAll(...)` helper methods to copy session attributes. - `InMemorySessionStore`: - Downgraded session identifier logging in `createSession()` from `INFO` to `DEBUG`. - Implemented `rotateSession()` to generate a new session identifier, copy over existing session attributes, invalidate the old session identifier in storage, and issue an updated `Set-Cookie` header and `CamelOAuthSessionId` message header. - `OAuthCodeFlowCallback`: Call `oauth.rotateSession(exchange, session)` upon receiving the authenticated user profile before redirecting to the post-login URL. - Upgrade guide 4.24: Added a note documenting that session identifiers are no longer logged at `INFO` and that `OAuthCodeFlowCallback` rotates session identifiers on login. ### Tests - Added `OAuthCodeFlowSessionRotationTest` in `camel-oauth` to test: - `InMemorySessionStore.rotateSession` replaces the session identifier, migrates existing values, invalidates the old session identifier, and emits an updated session cookie and message header. - `OAuthCodeFlowCallback` rotates the session identifier upon successful authentication, preventing subsequent requests with the pre-login session identifier from executing protected routes, while requests presenting the rotated post-login session identifier execute with the authenticated user profile. - Updated `AbstractOAuthRequestHeadersTest.loginAsBob()` to pick up the updated session cookie emitted by the callback. - All 208 unit and integration tests in `camel-oauth` pass cleanly. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
