This is an automated email from the ASF dual-hosted git repository.

davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git


The following commit(s) were added to refs/heads/main by this push:
     new 44700f094e42 CAMEL-26335: camel-cometd - configure allowedTransports 
and disable callback-polling by default (#28555)
44700f094e42 is described below

commit 44700f094e42103b0f3e072cecd0281fc6fcbf79
Author: Andrea Cosentino <[email protected]>
AuthorDate: Tue Oct 27 13:04:42 2026 +0100

    CAMEL-26335: camel-cometd - configure allowedTransports and disable 
callback-polling by default (#28555)
    
    Configure the allowedTransports parameter on CometdEndpoint and 
CometdComponent to restrict accepted Bayeux transport mechanisms.
    By default, allowedTransports defaults to "websocket,long-polling", 
disabling callback-polling.
    Users requiring callback-polling can explicitly configure allowedTransports 
on the endpoint.
    
    Co-authored-by: Claude Opus 4.8 <[email protected]>
    Signed-off-by: Andrea Cosentino <[email protected]>
---
 .../apache/camel/catalog/components/cometd.json    |  33 +++----
 .../apache/camel/catalog/components/cometds.json   |  33 +++----
 .../camel/catalog/docs/cometd-component.adoc       |  15 +++
 .../component/cometd/CometdEndpointConfigurer.java |   6 ++
 .../component/cometd/CometdEndpointUriFactory.java |   3 +-
 .../org/apache/camel/component/cometd/cometd.json  |  33 +++----
 .../org/apache/camel/component/cometd/cometds.json |  33 +++----
 .../src/main/docs/cometd-component.adoc            |  15 +++
 .../camel/component/cometd/CometdComponent.java    |   9 ++
 .../camel/component/cometd/CometdEndpoint.java     |  15 +++
 .../cometd/CometdAllowedTransportsTest.java        | 104 +++++++++++++++++++++
 .../ROOT/pages/camel-4x-upgrade-guide-4_24.adoc    |   7 ++
 .../endpoint/dsl/CometdEndpointBuilderFactory.java |  57 +++++++++++
 13 files changed, 298 insertions(+), 65 deletions(-)

diff --git 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/cometd.json
 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/cometd.json
index 063e7f61f736..5737e8a07f07 100644
--- 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/cometd.json
+++ 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/cometd.json
@@ -51,21 +51,22 @@
     "port": { "index": 1, "kind": "path", "displayName": "Port", "group": 
"common", "label": "", "required": true, "type": "integer", "javaType": "int", 
"deprecated": false, "deprecationNote": "", "autowired": false, "secret": 
false, "description": "Host port number" },
     "channelName": { "index": 2, "kind": "path", "displayName": "Channel 
Name", "group": "common", "label": "", "required": true, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "deprecationNote": "", 
"autowired": false, "secret": false, "description": "The channelName represents 
a topic that can be subscribed to by the Camel endpoints." },
     "allowedOrigins": { "index": 3, "kind": "parameter", "displayName": 
"Allowed Origins", "group": "common", "label": "", "required": false, "type": 
"string", "javaType": "java.lang.String", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": "*", "description": "The origins domain 
that support to cross, if the crosssOriginFilterOn is true" },
-    "baseResource": { "index": 4, "kind": "parameter", "displayName": "Base 
Resource", "group": "common", "label": "", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "The root directory for the web resources or 
classpath. Use the protocol file: or classpath: depending if you want that the 
component loads the resource from file system or classpath. Classpath is 
required for OSGI deployment where [...]
-    "crossOriginFilterOn": { "index": 5, "kind": "parameter", "displayName": 
"Cross Origin Filter On", "group": "common", "label": "", "required": false, 
"type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If true, the 
server will support for cross-domain filtering" },
-    "filterPath": { "index": 6, "kind": "parameter", "displayName": "Filter 
Path", "group": "common", "label": "", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "The filterPath will be used by the 
CrossOriginFilter, if the crosssOriginFilterOn is true" },
-    "interval": { "index": 7, "kind": "parameter", "displayName": "Interval", 
"group": "common", "label": "", "required": false, "type": "integer", 
"javaType": "int", "deprecated": false, "autowired": false, "secret": false, 
"description": "The client side poll timeout in milliseconds. How long a client 
will wait between reconnects" },
-    "jsonCommented": { "index": 8, "kind": "parameter", "displayName": "Json 
Commented", "group": "common", "label": "", "required": false, "type": 
"boolean", "javaType": "boolean", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": true, "description": "If true, the server will 
accept JSON wrapped in a comment and will generate JSON wrapped in a comment. 
This is a defence against Ajax Hijacking." },
-    "logLevel": { "index": 9, "kind": "parameter", "displayName": "Log Level", 
"group": "common", "label": "", "required": false, "type": "enum", "javaType": 
"int", "enum": [ "0", "1", "2" ], "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 1, "description": "Logging level. 0=none, 
1=info, 2=debug." },
-    "maxInterval": { "index": 10, "kind": "parameter", "displayName": "Max 
Interval", "group": "common", "label": "", "required": false, "type": 
"integer", "javaType": "int", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 30000, "description": "The max client side 
poll timeout in milliseconds. A client will be removed if a connection is not 
received in this time." },
-    "multiFrameInterval": { "index": 11, "kind": "parameter", "displayName": 
"Multi Frame Interval", "group": "common", "label": "", "required": false, 
"type": "integer", "javaType": "int", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 1500, "description": "The client side poll 
timeout, if multiple connections are detected from the same browser." },
-    "timeout": { "index": 12, "kind": "parameter", "displayName": "Timeout", 
"group": "common", "label": "", "required": false, "type": "integer", 
"javaType": "int", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": 240000, "description": "The server side poll timeout in 
milliseconds. This is how long the server will hold a reconnect request before 
responding." },
-    "sessionHeadersEnabled": { "index": 13, "kind": "parameter", 
"displayName": "Session Headers Enabled", "group": "consumer", "label": 
"consumer", "required": false, "type": "boolean", "javaType": "boolean", 
"deprecated": false, "autowired": false, "secret": false, "defaultValue": 
false, "description": "Whether to include the server session headers in the 
Camel message when creating a Camel Message for incoming requests." },
-    "bridgeErrorHandler": { "index": 14, "kind": "parameter", "displayName": 
"Bridge Error Handler", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "boolean", "javaType": 
"boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "Allows for bridging the consumer to the 
Camel routing Error Handler, which mean any exceptions (if possible) occurred 
while the Camel consumer is trying to pickup incoming [...]
-    "exceptionHandler": { "index": 15, "kind": "parameter", "displayName": 
"Exception Handler", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "object", "javaType": 
"org.apache.camel.spi.ExceptionHandler", "optionalPrefix": "consumer.", 
"deprecated": false, "autowired": false, "secret": false, "description": "To 
let the consumer use a custom ExceptionHandler. Notice if the option 
bridgeErrorHandler is enabled then this option is not in use. By de [...]
-    "exchangePattern": { "index": 16, "kind": "parameter", "displayName": 
"Exchange Pattern", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "enum", "javaType": 
"org.apache.camel.ExchangePattern", "enum": [ "InOnly", "InOut" ], 
"deprecated": false, "autowired": false, "secret": false, "description": "Sets 
the exchange pattern when the consumer creates an exchange." },
-    "disconnectLocalSession": { "index": 17, "kind": "parameter", 
"displayName": "Disconnect Local Session", "group": "producer", "label": 
"producer", "required": false, "type": "boolean", "javaType": "boolean", 
"deprecated": false, "autowired": false, "secret": false, "defaultValue": 
false, "description": "Whether to disconnect local sessions after publishing a 
message to its channel. Disconnecting local session is needed as they are not 
swept by default by CometD, and therefore you can [...]
-    "lazyStartProducer": { "index": 18, "kind": "parameter", "displayName": 
"Lazy Start Producer", "group": "producer (advanced)", "label": 
"producer,advanced", "required": false, "type": "boolean", "javaType": 
"boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "Whether the producer should be started 
lazy (on the first message). By starting lazy you can use this to allow 
CamelContext and routes to startup in situations where a produ [...]
-    "headerFilterStrategy": { "index": 19, "kind": "parameter", "displayName": 
"Header Filter Strategy", "group": "advanced", "label": "advanced", "required": 
false, "type": "object", "javaType": 
"org.apache.camel.spi.HeaderFilterStrategy", "deprecated": false, "autowired": 
false, "secret": false, "description": "To use a custom HeaderFilterStrategy to 
filter headers." }
+    "allowedTransports": { "index": 4, "kind": "parameter", "displayName": 
"Allowed Transports", "group": "common", "label": "", "required": false, 
"type": "string", "javaType": "java.lang.String", "deprecated": false, 
"autowired": false, "secret": false, "defaultValue": "websocket,long-polling", 
"description": "A comma-separated list of transport names allowed by the CometD 
server (e.g. websocket, long-polling, callback-polling). callback-polling is 
the JSONP transport mechanism. This o [...]
+    "baseResource": { "index": 5, "kind": "parameter", "displayName": "Base 
Resource", "group": "common", "label": "", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "The root directory for the web resources or 
classpath. Use the protocol file: or classpath: depending if you want that the 
component loads the resource from file system or classpath. Classpath is 
required for OSGI deployment where [...]
+    "crossOriginFilterOn": { "index": 6, "kind": "parameter", "displayName": 
"Cross Origin Filter On", "group": "common", "label": "", "required": false, 
"type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If true, the 
server will support for cross-domain filtering" },
+    "filterPath": { "index": 7, "kind": "parameter", "displayName": "Filter 
Path", "group": "common", "label": "", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "The filterPath will be used by the 
CrossOriginFilter, if the crosssOriginFilterOn is true" },
+    "interval": { "index": 8, "kind": "parameter", "displayName": "Interval", 
"group": "common", "label": "", "required": false, "type": "integer", 
"javaType": "int", "deprecated": false, "autowired": false, "secret": false, 
"description": "The client side poll timeout in milliseconds. How long a client 
will wait between reconnects" },
+    "jsonCommented": { "index": 9, "kind": "parameter", "displayName": "Json 
Commented", "group": "common", "label": "", "required": false, "type": 
"boolean", "javaType": "boolean", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": true, "description": "If true, the server will 
accept JSON wrapped in a comment and will generate JSON wrapped in a comment. 
This is a defence against Ajax Hijacking." },
+    "logLevel": { "index": 10, "kind": "parameter", "displayName": "Log 
Level", "group": "common", "label": "", "required": false, "type": "enum", 
"javaType": "int", "enum": [ "0", "1", "2" ], "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": 1, "description": "Logging level. 
0=none, 1=info, 2=debug." },
+    "maxInterval": { "index": 11, "kind": "parameter", "displayName": "Max 
Interval", "group": "common", "label": "", "required": false, "type": 
"integer", "javaType": "int", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 30000, "description": "The max client side 
poll timeout in milliseconds. A client will be removed if a connection is not 
received in this time." },
+    "multiFrameInterval": { "index": 12, "kind": "parameter", "displayName": 
"Multi Frame Interval", "group": "common", "label": "", "required": false, 
"type": "integer", "javaType": "int", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 1500, "description": "The client side poll 
timeout, if multiple connections are detected from the same browser." },
+    "timeout": { "index": 13, "kind": "parameter", "displayName": "Timeout", 
"group": "common", "label": "", "required": false, "type": "integer", 
"javaType": "int", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": 240000, "description": "The server side poll timeout in 
milliseconds. This is how long the server will hold a reconnect request before 
responding." },
+    "sessionHeadersEnabled": { "index": 14, "kind": "parameter", 
"displayName": "Session Headers Enabled", "group": "consumer", "label": 
"consumer", "required": false, "type": "boolean", "javaType": "boolean", 
"deprecated": false, "autowired": false, "secret": false, "defaultValue": 
false, "description": "Whether to include the server session headers in the 
Camel message when creating a Camel Message for incoming requests." },
+    "bridgeErrorHandler": { "index": 15, "kind": "parameter", "displayName": 
"Bridge Error Handler", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "boolean", "javaType": 
"boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "Allows for bridging the consumer to the 
Camel routing Error Handler, which mean any exceptions (if possible) occurred 
while the Camel consumer is trying to pickup incoming [...]
+    "exceptionHandler": { "index": 16, "kind": "parameter", "displayName": 
"Exception Handler", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "object", "javaType": 
"org.apache.camel.spi.ExceptionHandler", "optionalPrefix": "consumer.", 
"deprecated": false, "autowired": false, "secret": false, "description": "To 
let the consumer use a custom ExceptionHandler. Notice if the option 
bridgeErrorHandler is enabled then this option is not in use. By de [...]
+    "exchangePattern": { "index": 17, "kind": "parameter", "displayName": 
"Exchange Pattern", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "enum", "javaType": 
"org.apache.camel.ExchangePattern", "enum": [ "InOnly", "InOut" ], 
"deprecated": false, "autowired": false, "secret": false, "description": "Sets 
the exchange pattern when the consumer creates an exchange." },
+    "disconnectLocalSession": { "index": 18, "kind": "parameter", 
"displayName": "Disconnect Local Session", "group": "producer", "label": 
"producer", "required": false, "type": "boolean", "javaType": "boolean", 
"deprecated": false, "autowired": false, "secret": false, "defaultValue": 
false, "description": "Whether to disconnect local sessions after publishing a 
message to its channel. Disconnecting local session is needed as they are not 
swept by default by CometD, and therefore you can [...]
+    "lazyStartProducer": { "index": 19, "kind": "parameter", "displayName": 
"Lazy Start Producer", "group": "producer (advanced)", "label": 
"producer,advanced", "required": false, "type": "boolean", "javaType": 
"boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "Whether the producer should be started 
lazy (on the first message). By starting lazy you can use this to allow 
CamelContext and routes to startup in situations where a produ [...]
+    "headerFilterStrategy": { "index": 20, "kind": "parameter", "displayName": 
"Header Filter Strategy", "group": "advanced", "label": "advanced", "required": 
false, "type": "object", "javaType": 
"org.apache.camel.spi.HeaderFilterStrategy", "deprecated": false, "autowired": 
false, "secret": false, "description": "To use a custom HeaderFilterStrategy to 
filter headers." }
   }
 }
diff --git 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/cometds.json
 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/cometds.json
index f45c80ef5ad4..f20d00b45f43 100644
--- 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/cometds.json
+++ 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/cometds.json
@@ -51,21 +51,22 @@
     "port": { "index": 1, "kind": "path", "displayName": "Port", "group": 
"common", "label": "", "required": true, "type": "integer", "javaType": "int", 
"deprecated": false, "deprecationNote": "", "autowired": false, "secret": 
false, "description": "Host port number" },
     "channelName": { "index": 2, "kind": "path", "displayName": "Channel 
Name", "group": "common", "label": "", "required": true, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "deprecationNote": "", 
"autowired": false, "secret": false, "description": "The channelName represents 
a topic that can be subscribed to by the Camel endpoints." },
     "allowedOrigins": { "index": 3, "kind": "parameter", "displayName": 
"Allowed Origins", "group": "common", "label": "", "required": false, "type": 
"string", "javaType": "java.lang.String", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": "*", "description": "The origins domain 
that support to cross, if the crosssOriginFilterOn is true" },
-    "baseResource": { "index": 4, "kind": "parameter", "displayName": "Base 
Resource", "group": "common", "label": "", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "The root directory for the web resources or 
classpath. Use the protocol file: or classpath: depending if you want that the 
component loads the resource from file system or classpath. Classpath is 
required for OSGI deployment where [...]
-    "crossOriginFilterOn": { "index": 5, "kind": "parameter", "displayName": 
"Cross Origin Filter On", "group": "common", "label": "", "required": false, 
"type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If true, the 
server will support for cross-domain filtering" },
-    "filterPath": { "index": 6, "kind": "parameter", "displayName": "Filter 
Path", "group": "common", "label": "", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "The filterPath will be used by the 
CrossOriginFilter, if the crosssOriginFilterOn is true" },
-    "interval": { "index": 7, "kind": "parameter", "displayName": "Interval", 
"group": "common", "label": "", "required": false, "type": "integer", 
"javaType": "int", "deprecated": false, "autowired": false, "secret": false, 
"description": "The client side poll timeout in milliseconds. How long a client 
will wait between reconnects" },
-    "jsonCommented": { "index": 8, "kind": "parameter", "displayName": "Json 
Commented", "group": "common", "label": "", "required": false, "type": 
"boolean", "javaType": "boolean", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": true, "description": "If true, the server will 
accept JSON wrapped in a comment and will generate JSON wrapped in a comment. 
This is a defence against Ajax Hijacking." },
-    "logLevel": { "index": 9, "kind": "parameter", "displayName": "Log Level", 
"group": "common", "label": "", "required": false, "type": "enum", "javaType": 
"int", "enum": [ "0", "1", "2" ], "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 1, "description": "Logging level. 0=none, 
1=info, 2=debug." },
-    "maxInterval": { "index": 10, "kind": "parameter", "displayName": "Max 
Interval", "group": "common", "label": "", "required": false, "type": 
"integer", "javaType": "int", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 30000, "description": "The max client side 
poll timeout in milliseconds. A client will be removed if a connection is not 
received in this time." },
-    "multiFrameInterval": { "index": 11, "kind": "parameter", "displayName": 
"Multi Frame Interval", "group": "common", "label": "", "required": false, 
"type": "integer", "javaType": "int", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 1500, "description": "The client side poll 
timeout, if multiple connections are detected from the same browser." },
-    "timeout": { "index": 12, "kind": "parameter", "displayName": "Timeout", 
"group": "common", "label": "", "required": false, "type": "integer", 
"javaType": "int", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": 240000, "description": "The server side poll timeout in 
milliseconds. This is how long the server will hold a reconnect request before 
responding." },
-    "sessionHeadersEnabled": { "index": 13, "kind": "parameter", 
"displayName": "Session Headers Enabled", "group": "consumer", "label": 
"consumer", "required": false, "type": "boolean", "javaType": "boolean", 
"deprecated": false, "autowired": false, "secret": false, "defaultValue": 
false, "description": "Whether to include the server session headers in the 
Camel message when creating a Camel Message for incoming requests." },
-    "bridgeErrorHandler": { "index": 14, "kind": "parameter", "displayName": 
"Bridge Error Handler", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "boolean", "javaType": 
"boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "Allows for bridging the consumer to the 
Camel routing Error Handler, which mean any exceptions (if possible) occurred 
while the Camel consumer is trying to pickup incoming [...]
-    "exceptionHandler": { "index": 15, "kind": "parameter", "displayName": 
"Exception Handler", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "object", "javaType": 
"org.apache.camel.spi.ExceptionHandler", "optionalPrefix": "consumer.", 
"deprecated": false, "autowired": false, "secret": false, "description": "To 
let the consumer use a custom ExceptionHandler. Notice if the option 
bridgeErrorHandler is enabled then this option is not in use. By de [...]
-    "exchangePattern": { "index": 16, "kind": "parameter", "displayName": 
"Exchange Pattern", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "enum", "javaType": 
"org.apache.camel.ExchangePattern", "enum": [ "InOnly", "InOut" ], 
"deprecated": false, "autowired": false, "secret": false, "description": "Sets 
the exchange pattern when the consumer creates an exchange." },
-    "disconnectLocalSession": { "index": 17, "kind": "parameter", 
"displayName": "Disconnect Local Session", "group": "producer", "label": 
"producer", "required": false, "type": "boolean", "javaType": "boolean", 
"deprecated": false, "autowired": false, "secret": false, "defaultValue": 
false, "description": "Whether to disconnect local sessions after publishing a 
message to its channel. Disconnecting local session is needed as they are not 
swept by default by CometD, and therefore you can [...]
-    "lazyStartProducer": { "index": 18, "kind": "parameter", "displayName": 
"Lazy Start Producer", "group": "producer (advanced)", "label": 
"producer,advanced", "required": false, "type": "boolean", "javaType": 
"boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "Whether the producer should be started 
lazy (on the first message). By starting lazy you can use this to allow 
CamelContext and routes to startup in situations where a produ [...]
-    "headerFilterStrategy": { "index": 19, "kind": "parameter", "displayName": 
"Header Filter Strategy", "group": "advanced", "label": "advanced", "required": 
false, "type": "object", "javaType": 
"org.apache.camel.spi.HeaderFilterStrategy", "deprecated": false, "autowired": 
false, "secret": false, "description": "To use a custom HeaderFilterStrategy to 
filter headers." }
+    "allowedTransports": { "index": 4, "kind": "parameter", "displayName": 
"Allowed Transports", "group": "common", "label": "", "required": false, 
"type": "string", "javaType": "java.lang.String", "deprecated": false, 
"autowired": false, "secret": false, "defaultValue": "websocket,long-polling", 
"description": "A comma-separated list of transport names allowed by the CometD 
server (e.g. websocket, long-polling, callback-polling). callback-polling is 
the JSONP transport mechanism. This o [...]
+    "baseResource": { "index": 5, "kind": "parameter", "displayName": "Base 
Resource", "group": "common", "label": "", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "The root directory for the web resources or 
classpath. Use the protocol file: or classpath: depending if you want that the 
component loads the resource from file system or classpath. Classpath is 
required for OSGI deployment where [...]
+    "crossOriginFilterOn": { "index": 6, "kind": "parameter", "displayName": 
"Cross Origin Filter On", "group": "common", "label": "", "required": false, 
"type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If true, the 
server will support for cross-domain filtering" },
+    "filterPath": { "index": 7, "kind": "parameter", "displayName": "Filter 
Path", "group": "common", "label": "", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "The filterPath will be used by the 
CrossOriginFilter, if the crosssOriginFilterOn is true" },
+    "interval": { "index": 8, "kind": "parameter", "displayName": "Interval", 
"group": "common", "label": "", "required": false, "type": "integer", 
"javaType": "int", "deprecated": false, "autowired": false, "secret": false, 
"description": "The client side poll timeout in milliseconds. How long a client 
will wait between reconnects" },
+    "jsonCommented": { "index": 9, "kind": "parameter", "displayName": "Json 
Commented", "group": "common", "label": "", "required": false, "type": 
"boolean", "javaType": "boolean", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": true, "description": "If true, the server will 
accept JSON wrapped in a comment and will generate JSON wrapped in a comment. 
This is a defence against Ajax Hijacking." },
+    "logLevel": { "index": 10, "kind": "parameter", "displayName": "Log 
Level", "group": "common", "label": "", "required": false, "type": "enum", 
"javaType": "int", "enum": [ "0", "1", "2" ], "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": 1, "description": "Logging level. 
0=none, 1=info, 2=debug." },
+    "maxInterval": { "index": 11, "kind": "parameter", "displayName": "Max 
Interval", "group": "common", "label": "", "required": false, "type": 
"integer", "javaType": "int", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 30000, "description": "The max client side 
poll timeout in milliseconds. A client will be removed if a connection is not 
received in this time." },
+    "multiFrameInterval": { "index": 12, "kind": "parameter", "displayName": 
"Multi Frame Interval", "group": "common", "label": "", "required": false, 
"type": "integer", "javaType": "int", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 1500, "description": "The client side poll 
timeout, if multiple connections are detected from the same browser." },
+    "timeout": { "index": 13, "kind": "parameter", "displayName": "Timeout", 
"group": "common", "label": "", "required": false, "type": "integer", 
"javaType": "int", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": 240000, "description": "The server side poll timeout in 
milliseconds. This is how long the server will hold a reconnect request before 
responding." },
+    "sessionHeadersEnabled": { "index": 14, "kind": "parameter", 
"displayName": "Session Headers Enabled", "group": "consumer", "label": 
"consumer", "required": false, "type": "boolean", "javaType": "boolean", 
"deprecated": false, "autowired": false, "secret": false, "defaultValue": 
false, "description": "Whether to include the server session headers in the 
Camel message when creating a Camel Message for incoming requests." },
+    "bridgeErrorHandler": { "index": 15, "kind": "parameter", "displayName": 
"Bridge Error Handler", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "boolean", "javaType": 
"boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "Allows for bridging the consumer to the 
Camel routing Error Handler, which mean any exceptions (if possible) occurred 
while the Camel consumer is trying to pickup incoming [...]
+    "exceptionHandler": { "index": 16, "kind": "parameter", "displayName": 
"Exception Handler", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "object", "javaType": 
"org.apache.camel.spi.ExceptionHandler", "optionalPrefix": "consumer.", 
"deprecated": false, "autowired": false, "secret": false, "description": "To 
let the consumer use a custom ExceptionHandler. Notice if the option 
bridgeErrorHandler is enabled then this option is not in use. By de [...]
+    "exchangePattern": { "index": 17, "kind": "parameter", "displayName": 
"Exchange Pattern", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "enum", "javaType": 
"org.apache.camel.ExchangePattern", "enum": [ "InOnly", "InOut" ], 
"deprecated": false, "autowired": false, "secret": false, "description": "Sets 
the exchange pattern when the consumer creates an exchange." },
+    "disconnectLocalSession": { "index": 18, "kind": "parameter", 
"displayName": "Disconnect Local Session", "group": "producer", "label": 
"producer", "required": false, "type": "boolean", "javaType": "boolean", 
"deprecated": false, "autowired": false, "secret": false, "defaultValue": 
false, "description": "Whether to disconnect local sessions after publishing a 
message to its channel. Disconnecting local session is needed as they are not 
swept by default by CometD, and therefore you can [...]
+    "lazyStartProducer": { "index": 19, "kind": "parameter", "displayName": 
"Lazy Start Producer", "group": "producer (advanced)", "label": 
"producer,advanced", "required": false, "type": "boolean", "javaType": 
"boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "Whether the producer should be started 
lazy (on the first message). By starting lazy you can use this to allow 
CamelContext and routes to startup in situations where a produ [...]
+    "headerFilterStrategy": { "index": 20, "kind": "parameter", "displayName": 
"Header Filter Strategy", "group": "advanced", "label": "advanced", "required": 
false, "type": "object", "javaType": 
"org.apache.camel.spi.HeaderFilterStrategy", "deprecated": false, "autowired": 
false, "secret": false, "description": "To use a custom HeaderFilterStrategy to 
filter headers." }
   }
 }
diff --git 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/cometd-component.adoc
 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/cometd-component.adoc
index 0e78ae0c3941..8a26cd30d024 100644
--- 
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/cometd-component.adoc
+++ 
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/cometd-component.adoc
@@ -88,6 +88,21 @@ of that channel:
             uri: cometd://0.0.0.0:9099/channel/orders
 ----
 
+=== Allowed Transports and JSONP
+
+By default, the CometD server allows `websocket` and `long-polling` transports 
(`allowedTransports=websocket,long-polling`),
+disabling the legacy JSONP (`callback-polling`) transport mechanism.
+
+To allow JSONP clients, configure `allowedTransports` explicitly on the 
endpoint URI:
+
+[source,text]
+----
+cometd://localhost:8080/service/mychannel?allowedTransports=websocket,long-polling,callback-polling
+----
+
+Because `allowedTransports` configures the underlying Bayeux server for a 
given host and port, the setting applies to
+all endpoints sharing that server.
+
 === Authentication
 
 You can configure custom `SecurityPolicy` and `Extension`'s to the
diff --git 
a/components/camel-cometd/src/generated/java/org/apache/camel/component/cometd/CometdEndpointConfigurer.java
 
b/components/camel-cometd/src/generated/java/org/apache/camel/component/cometd/CometdEndpointConfigurer.java
index fe410ffa6fc0..48d2bc84a655 100644
--- 
a/components/camel-cometd/src/generated/java/org/apache/camel/component/cometd/CometdEndpointConfigurer.java
+++ 
b/components/camel-cometd/src/generated/java/org/apache/camel/component/cometd/CometdEndpointConfigurer.java
@@ -25,6 +25,8 @@ public class CometdEndpointConfigurer extends 
PropertyConfigurerSupport implemen
         switch (ignoreCase ? name.toLowerCase() : name) {
         case "allowedorigins":
         case "allowedOrigins": target.setAllowedOrigins(property(camelContext, 
java.lang.String.class, value)); return true;
+        case "allowedtransports":
+        case "allowedTransports": 
target.setAllowedTransports(property(camelContext, java.lang.String.class, 
value)); return true;
         case "baseresource":
         case "baseResource": target.setBaseResource(property(camelContext, 
java.lang.String.class, value)); return true;
         case "bridgeerrorhandler":
@@ -64,6 +66,8 @@ public class CometdEndpointConfigurer extends 
PropertyConfigurerSupport implemen
         switch (ignoreCase ? name.toLowerCase() : name) {
         case "allowedorigins":
         case "allowedOrigins": return java.lang.String.class;
+        case "allowedtransports":
+        case "allowedTransports": return java.lang.String.class;
         case "baseresource":
         case "baseResource": return java.lang.String.class;
         case "bridgeerrorhandler":
@@ -104,6 +108,8 @@ public class CometdEndpointConfigurer extends 
PropertyConfigurerSupport implemen
         switch (ignoreCase ? name.toLowerCase() : name) {
         case "allowedorigins":
         case "allowedOrigins": return target.getAllowedOrigins();
+        case "allowedtransports":
+        case "allowedTransports": return target.getAllowedTransports();
         case "baseresource":
         case "baseResource": return target.getBaseResource();
         case "bridgeerrorhandler":
diff --git 
a/components/camel-cometd/src/generated/java/org/apache/camel/component/cometd/CometdEndpointUriFactory.java
 
b/components/camel-cometd/src/generated/java/org/apache/camel/component/cometd/CometdEndpointUriFactory.java
index 9bc91226cdda..a7bc0c850192 100644
--- 
a/components/camel-cometd/src/generated/java/org/apache/camel/component/cometd/CometdEndpointUriFactory.java
+++ 
b/components/camel-cometd/src/generated/java/org/apache/camel/component/cometd/CometdEndpointUriFactory.java
@@ -25,8 +25,9 @@ public class CometdEndpointUriFactory extends 
org.apache.camel.support.component
     private static final Set<String> ENDPOINT_IDENTITY_PROPERTY_NAMES;
     private static final Map<String, String> MULTI_VALUE_PREFIXES;
     static {
-        Set<String> props = new HashSet<>(20);
+        Set<String> props = new HashSet<>(21);
         props.add("allowedOrigins");
+        props.add("allowedTransports");
         props.add("baseResource");
         props.add("bridgeErrorHandler");
         props.add("channelName");
diff --git 
a/components/camel-cometd/src/generated/resources/META-INF/org/apache/camel/component/cometd/cometd.json
 
b/components/camel-cometd/src/generated/resources/META-INF/org/apache/camel/component/cometd/cometd.json
index 063e7f61f736..5737e8a07f07 100644
--- 
a/components/camel-cometd/src/generated/resources/META-INF/org/apache/camel/component/cometd/cometd.json
+++ 
b/components/camel-cometd/src/generated/resources/META-INF/org/apache/camel/component/cometd/cometd.json
@@ -51,21 +51,22 @@
     "port": { "index": 1, "kind": "path", "displayName": "Port", "group": 
"common", "label": "", "required": true, "type": "integer", "javaType": "int", 
"deprecated": false, "deprecationNote": "", "autowired": false, "secret": 
false, "description": "Host port number" },
     "channelName": { "index": 2, "kind": "path", "displayName": "Channel 
Name", "group": "common", "label": "", "required": true, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "deprecationNote": "", 
"autowired": false, "secret": false, "description": "The channelName represents 
a topic that can be subscribed to by the Camel endpoints." },
     "allowedOrigins": { "index": 3, "kind": "parameter", "displayName": 
"Allowed Origins", "group": "common", "label": "", "required": false, "type": 
"string", "javaType": "java.lang.String", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": "*", "description": "The origins domain 
that support to cross, if the crosssOriginFilterOn is true" },
-    "baseResource": { "index": 4, "kind": "parameter", "displayName": "Base 
Resource", "group": "common", "label": "", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "The root directory for the web resources or 
classpath. Use the protocol file: or classpath: depending if you want that the 
component loads the resource from file system or classpath. Classpath is 
required for OSGI deployment where [...]
-    "crossOriginFilterOn": { "index": 5, "kind": "parameter", "displayName": 
"Cross Origin Filter On", "group": "common", "label": "", "required": false, 
"type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If true, the 
server will support for cross-domain filtering" },
-    "filterPath": { "index": 6, "kind": "parameter", "displayName": "Filter 
Path", "group": "common", "label": "", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "The filterPath will be used by the 
CrossOriginFilter, if the crosssOriginFilterOn is true" },
-    "interval": { "index": 7, "kind": "parameter", "displayName": "Interval", 
"group": "common", "label": "", "required": false, "type": "integer", 
"javaType": "int", "deprecated": false, "autowired": false, "secret": false, 
"description": "The client side poll timeout in milliseconds. How long a client 
will wait between reconnects" },
-    "jsonCommented": { "index": 8, "kind": "parameter", "displayName": "Json 
Commented", "group": "common", "label": "", "required": false, "type": 
"boolean", "javaType": "boolean", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": true, "description": "If true, the server will 
accept JSON wrapped in a comment and will generate JSON wrapped in a comment. 
This is a defence against Ajax Hijacking." },
-    "logLevel": { "index": 9, "kind": "parameter", "displayName": "Log Level", 
"group": "common", "label": "", "required": false, "type": "enum", "javaType": 
"int", "enum": [ "0", "1", "2" ], "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 1, "description": "Logging level. 0=none, 
1=info, 2=debug." },
-    "maxInterval": { "index": 10, "kind": "parameter", "displayName": "Max 
Interval", "group": "common", "label": "", "required": false, "type": 
"integer", "javaType": "int", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 30000, "description": "The max client side 
poll timeout in milliseconds. A client will be removed if a connection is not 
received in this time." },
-    "multiFrameInterval": { "index": 11, "kind": "parameter", "displayName": 
"Multi Frame Interval", "group": "common", "label": "", "required": false, 
"type": "integer", "javaType": "int", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 1500, "description": "The client side poll 
timeout, if multiple connections are detected from the same browser." },
-    "timeout": { "index": 12, "kind": "parameter", "displayName": "Timeout", 
"group": "common", "label": "", "required": false, "type": "integer", 
"javaType": "int", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": 240000, "description": "The server side poll timeout in 
milliseconds. This is how long the server will hold a reconnect request before 
responding." },
-    "sessionHeadersEnabled": { "index": 13, "kind": "parameter", 
"displayName": "Session Headers Enabled", "group": "consumer", "label": 
"consumer", "required": false, "type": "boolean", "javaType": "boolean", 
"deprecated": false, "autowired": false, "secret": false, "defaultValue": 
false, "description": "Whether to include the server session headers in the 
Camel message when creating a Camel Message for incoming requests." },
-    "bridgeErrorHandler": { "index": 14, "kind": "parameter", "displayName": 
"Bridge Error Handler", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "boolean", "javaType": 
"boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "Allows for bridging the consumer to the 
Camel routing Error Handler, which mean any exceptions (if possible) occurred 
while the Camel consumer is trying to pickup incoming [...]
-    "exceptionHandler": { "index": 15, "kind": "parameter", "displayName": 
"Exception Handler", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "object", "javaType": 
"org.apache.camel.spi.ExceptionHandler", "optionalPrefix": "consumer.", 
"deprecated": false, "autowired": false, "secret": false, "description": "To 
let the consumer use a custom ExceptionHandler. Notice if the option 
bridgeErrorHandler is enabled then this option is not in use. By de [...]
-    "exchangePattern": { "index": 16, "kind": "parameter", "displayName": 
"Exchange Pattern", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "enum", "javaType": 
"org.apache.camel.ExchangePattern", "enum": [ "InOnly", "InOut" ], 
"deprecated": false, "autowired": false, "secret": false, "description": "Sets 
the exchange pattern when the consumer creates an exchange." },
-    "disconnectLocalSession": { "index": 17, "kind": "parameter", 
"displayName": "Disconnect Local Session", "group": "producer", "label": 
"producer", "required": false, "type": "boolean", "javaType": "boolean", 
"deprecated": false, "autowired": false, "secret": false, "defaultValue": 
false, "description": "Whether to disconnect local sessions after publishing a 
message to its channel. Disconnecting local session is needed as they are not 
swept by default by CometD, and therefore you can [...]
-    "lazyStartProducer": { "index": 18, "kind": "parameter", "displayName": 
"Lazy Start Producer", "group": "producer (advanced)", "label": 
"producer,advanced", "required": false, "type": "boolean", "javaType": 
"boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "Whether the producer should be started 
lazy (on the first message). By starting lazy you can use this to allow 
CamelContext and routes to startup in situations where a produ [...]
-    "headerFilterStrategy": { "index": 19, "kind": "parameter", "displayName": 
"Header Filter Strategy", "group": "advanced", "label": "advanced", "required": 
false, "type": "object", "javaType": 
"org.apache.camel.spi.HeaderFilterStrategy", "deprecated": false, "autowired": 
false, "secret": false, "description": "To use a custom HeaderFilterStrategy to 
filter headers." }
+    "allowedTransports": { "index": 4, "kind": "parameter", "displayName": 
"Allowed Transports", "group": "common", "label": "", "required": false, 
"type": "string", "javaType": "java.lang.String", "deprecated": false, 
"autowired": false, "secret": false, "defaultValue": "websocket,long-polling", 
"description": "A comma-separated list of transport names allowed by the CometD 
server (e.g. websocket, long-polling, callback-polling). callback-polling is 
the JSONP transport mechanism. This o [...]
+    "baseResource": { "index": 5, "kind": "parameter", "displayName": "Base 
Resource", "group": "common", "label": "", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "The root directory for the web resources or 
classpath. Use the protocol file: or classpath: depending if you want that the 
component loads the resource from file system or classpath. Classpath is 
required for OSGI deployment where [...]
+    "crossOriginFilterOn": { "index": 6, "kind": "parameter", "displayName": 
"Cross Origin Filter On", "group": "common", "label": "", "required": false, 
"type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If true, the 
server will support for cross-domain filtering" },
+    "filterPath": { "index": 7, "kind": "parameter", "displayName": "Filter 
Path", "group": "common", "label": "", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "The filterPath will be used by the 
CrossOriginFilter, if the crosssOriginFilterOn is true" },
+    "interval": { "index": 8, "kind": "parameter", "displayName": "Interval", 
"group": "common", "label": "", "required": false, "type": "integer", 
"javaType": "int", "deprecated": false, "autowired": false, "secret": false, 
"description": "The client side poll timeout in milliseconds. How long a client 
will wait between reconnects" },
+    "jsonCommented": { "index": 9, "kind": "parameter", "displayName": "Json 
Commented", "group": "common", "label": "", "required": false, "type": 
"boolean", "javaType": "boolean", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": true, "description": "If true, the server will 
accept JSON wrapped in a comment and will generate JSON wrapped in a comment. 
This is a defence against Ajax Hijacking." },
+    "logLevel": { "index": 10, "kind": "parameter", "displayName": "Log 
Level", "group": "common", "label": "", "required": false, "type": "enum", 
"javaType": "int", "enum": [ "0", "1", "2" ], "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": 1, "description": "Logging level. 
0=none, 1=info, 2=debug." },
+    "maxInterval": { "index": 11, "kind": "parameter", "displayName": "Max 
Interval", "group": "common", "label": "", "required": false, "type": 
"integer", "javaType": "int", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 30000, "description": "The max client side 
poll timeout in milliseconds. A client will be removed if a connection is not 
received in this time." },
+    "multiFrameInterval": { "index": 12, "kind": "parameter", "displayName": 
"Multi Frame Interval", "group": "common", "label": "", "required": false, 
"type": "integer", "javaType": "int", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 1500, "description": "The client side poll 
timeout, if multiple connections are detected from the same browser." },
+    "timeout": { "index": 13, "kind": "parameter", "displayName": "Timeout", 
"group": "common", "label": "", "required": false, "type": "integer", 
"javaType": "int", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": 240000, "description": "The server side poll timeout in 
milliseconds. This is how long the server will hold a reconnect request before 
responding." },
+    "sessionHeadersEnabled": { "index": 14, "kind": "parameter", 
"displayName": "Session Headers Enabled", "group": "consumer", "label": 
"consumer", "required": false, "type": "boolean", "javaType": "boolean", 
"deprecated": false, "autowired": false, "secret": false, "defaultValue": 
false, "description": "Whether to include the server session headers in the 
Camel message when creating a Camel Message for incoming requests." },
+    "bridgeErrorHandler": { "index": 15, "kind": "parameter", "displayName": 
"Bridge Error Handler", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "boolean", "javaType": 
"boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "Allows for bridging the consumer to the 
Camel routing Error Handler, which mean any exceptions (if possible) occurred 
while the Camel consumer is trying to pickup incoming [...]
+    "exceptionHandler": { "index": 16, "kind": "parameter", "displayName": 
"Exception Handler", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "object", "javaType": 
"org.apache.camel.spi.ExceptionHandler", "optionalPrefix": "consumer.", 
"deprecated": false, "autowired": false, "secret": false, "description": "To 
let the consumer use a custom ExceptionHandler. Notice if the option 
bridgeErrorHandler is enabled then this option is not in use. By de [...]
+    "exchangePattern": { "index": 17, "kind": "parameter", "displayName": 
"Exchange Pattern", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "enum", "javaType": 
"org.apache.camel.ExchangePattern", "enum": [ "InOnly", "InOut" ], 
"deprecated": false, "autowired": false, "secret": false, "description": "Sets 
the exchange pattern when the consumer creates an exchange." },
+    "disconnectLocalSession": { "index": 18, "kind": "parameter", 
"displayName": "Disconnect Local Session", "group": "producer", "label": 
"producer", "required": false, "type": "boolean", "javaType": "boolean", 
"deprecated": false, "autowired": false, "secret": false, "defaultValue": 
false, "description": "Whether to disconnect local sessions after publishing a 
message to its channel. Disconnecting local session is needed as they are not 
swept by default by CometD, and therefore you can [...]
+    "lazyStartProducer": { "index": 19, "kind": "parameter", "displayName": 
"Lazy Start Producer", "group": "producer (advanced)", "label": 
"producer,advanced", "required": false, "type": "boolean", "javaType": 
"boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "Whether the producer should be started 
lazy (on the first message). By starting lazy you can use this to allow 
CamelContext and routes to startup in situations where a produ [...]
+    "headerFilterStrategy": { "index": 20, "kind": "parameter", "displayName": 
"Header Filter Strategy", "group": "advanced", "label": "advanced", "required": 
false, "type": "object", "javaType": 
"org.apache.camel.spi.HeaderFilterStrategy", "deprecated": false, "autowired": 
false, "secret": false, "description": "To use a custom HeaderFilterStrategy to 
filter headers." }
   }
 }
diff --git 
a/components/camel-cometd/src/generated/resources/META-INF/org/apache/camel/component/cometd/cometds.json
 
b/components/camel-cometd/src/generated/resources/META-INF/org/apache/camel/component/cometd/cometds.json
index f45c80ef5ad4..f20d00b45f43 100644
--- 
a/components/camel-cometd/src/generated/resources/META-INF/org/apache/camel/component/cometd/cometds.json
+++ 
b/components/camel-cometd/src/generated/resources/META-INF/org/apache/camel/component/cometd/cometds.json
@@ -51,21 +51,22 @@
     "port": { "index": 1, "kind": "path", "displayName": "Port", "group": 
"common", "label": "", "required": true, "type": "integer", "javaType": "int", 
"deprecated": false, "deprecationNote": "", "autowired": false, "secret": 
false, "description": "Host port number" },
     "channelName": { "index": 2, "kind": "path", "displayName": "Channel 
Name", "group": "common", "label": "", "required": true, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "deprecationNote": "", 
"autowired": false, "secret": false, "description": "The channelName represents 
a topic that can be subscribed to by the Camel endpoints." },
     "allowedOrigins": { "index": 3, "kind": "parameter", "displayName": 
"Allowed Origins", "group": "common", "label": "", "required": false, "type": 
"string", "javaType": "java.lang.String", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": "*", "description": "The origins domain 
that support to cross, if the crosssOriginFilterOn is true" },
-    "baseResource": { "index": 4, "kind": "parameter", "displayName": "Base 
Resource", "group": "common", "label": "", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "The root directory for the web resources or 
classpath. Use the protocol file: or classpath: depending if you want that the 
component loads the resource from file system or classpath. Classpath is 
required for OSGI deployment where [...]
-    "crossOriginFilterOn": { "index": 5, "kind": "parameter", "displayName": 
"Cross Origin Filter On", "group": "common", "label": "", "required": false, 
"type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If true, the 
server will support for cross-domain filtering" },
-    "filterPath": { "index": 6, "kind": "parameter", "displayName": "Filter 
Path", "group": "common", "label": "", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "The filterPath will be used by the 
CrossOriginFilter, if the crosssOriginFilterOn is true" },
-    "interval": { "index": 7, "kind": "parameter", "displayName": "Interval", 
"group": "common", "label": "", "required": false, "type": "integer", 
"javaType": "int", "deprecated": false, "autowired": false, "secret": false, 
"description": "The client side poll timeout in milliseconds. How long a client 
will wait between reconnects" },
-    "jsonCommented": { "index": 8, "kind": "parameter", "displayName": "Json 
Commented", "group": "common", "label": "", "required": false, "type": 
"boolean", "javaType": "boolean", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": true, "description": "If true, the server will 
accept JSON wrapped in a comment and will generate JSON wrapped in a comment. 
This is a defence against Ajax Hijacking." },
-    "logLevel": { "index": 9, "kind": "parameter", "displayName": "Log Level", 
"group": "common", "label": "", "required": false, "type": "enum", "javaType": 
"int", "enum": [ "0", "1", "2" ], "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 1, "description": "Logging level. 0=none, 
1=info, 2=debug." },
-    "maxInterval": { "index": 10, "kind": "parameter", "displayName": "Max 
Interval", "group": "common", "label": "", "required": false, "type": 
"integer", "javaType": "int", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 30000, "description": "The max client side 
poll timeout in milliseconds. A client will be removed if a connection is not 
received in this time." },
-    "multiFrameInterval": { "index": 11, "kind": "parameter", "displayName": 
"Multi Frame Interval", "group": "common", "label": "", "required": false, 
"type": "integer", "javaType": "int", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 1500, "description": "The client side poll 
timeout, if multiple connections are detected from the same browser." },
-    "timeout": { "index": 12, "kind": "parameter", "displayName": "Timeout", 
"group": "common", "label": "", "required": false, "type": "integer", 
"javaType": "int", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": 240000, "description": "The server side poll timeout in 
milliseconds. This is how long the server will hold a reconnect request before 
responding." },
-    "sessionHeadersEnabled": { "index": 13, "kind": "parameter", 
"displayName": "Session Headers Enabled", "group": "consumer", "label": 
"consumer", "required": false, "type": "boolean", "javaType": "boolean", 
"deprecated": false, "autowired": false, "secret": false, "defaultValue": 
false, "description": "Whether to include the server session headers in the 
Camel message when creating a Camel Message for incoming requests." },
-    "bridgeErrorHandler": { "index": 14, "kind": "parameter", "displayName": 
"Bridge Error Handler", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "boolean", "javaType": 
"boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "Allows for bridging the consumer to the 
Camel routing Error Handler, which mean any exceptions (if possible) occurred 
while the Camel consumer is trying to pickup incoming [...]
-    "exceptionHandler": { "index": 15, "kind": "parameter", "displayName": 
"Exception Handler", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "object", "javaType": 
"org.apache.camel.spi.ExceptionHandler", "optionalPrefix": "consumer.", 
"deprecated": false, "autowired": false, "secret": false, "description": "To 
let the consumer use a custom ExceptionHandler. Notice if the option 
bridgeErrorHandler is enabled then this option is not in use. By de [...]
-    "exchangePattern": { "index": 16, "kind": "parameter", "displayName": 
"Exchange Pattern", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "enum", "javaType": 
"org.apache.camel.ExchangePattern", "enum": [ "InOnly", "InOut" ], 
"deprecated": false, "autowired": false, "secret": false, "description": "Sets 
the exchange pattern when the consumer creates an exchange." },
-    "disconnectLocalSession": { "index": 17, "kind": "parameter", 
"displayName": "Disconnect Local Session", "group": "producer", "label": 
"producer", "required": false, "type": "boolean", "javaType": "boolean", 
"deprecated": false, "autowired": false, "secret": false, "defaultValue": 
false, "description": "Whether to disconnect local sessions after publishing a 
message to its channel. Disconnecting local session is needed as they are not 
swept by default by CometD, and therefore you can [...]
-    "lazyStartProducer": { "index": 18, "kind": "parameter", "displayName": 
"Lazy Start Producer", "group": "producer (advanced)", "label": 
"producer,advanced", "required": false, "type": "boolean", "javaType": 
"boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "Whether the producer should be started 
lazy (on the first message). By starting lazy you can use this to allow 
CamelContext and routes to startup in situations where a produ [...]
-    "headerFilterStrategy": { "index": 19, "kind": "parameter", "displayName": 
"Header Filter Strategy", "group": "advanced", "label": "advanced", "required": 
false, "type": "object", "javaType": 
"org.apache.camel.spi.HeaderFilterStrategy", "deprecated": false, "autowired": 
false, "secret": false, "description": "To use a custom HeaderFilterStrategy to 
filter headers." }
+    "allowedTransports": { "index": 4, "kind": "parameter", "displayName": 
"Allowed Transports", "group": "common", "label": "", "required": false, 
"type": "string", "javaType": "java.lang.String", "deprecated": false, 
"autowired": false, "secret": false, "defaultValue": "websocket,long-polling", 
"description": "A comma-separated list of transport names allowed by the CometD 
server (e.g. websocket, long-polling, callback-polling). callback-polling is 
the JSONP transport mechanism. This o [...]
+    "baseResource": { "index": 5, "kind": "parameter", "displayName": "Base 
Resource", "group": "common", "label": "", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "The root directory for the web resources or 
classpath. Use the protocol file: or classpath: depending if you want that the 
component loads the resource from file system or classpath. Classpath is 
required for OSGI deployment where [...]
+    "crossOriginFilterOn": { "index": 6, "kind": "parameter", "displayName": 
"Cross Origin Filter On", "group": "common", "label": "", "required": false, 
"type": "boolean", "javaType": "boolean", "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": false, "description": "If true, the 
server will support for cross-domain filtering" },
+    "filterPath": { "index": 7, "kind": "parameter", "displayName": "Filter 
Path", "group": "common", "label": "", "required": false, "type": "string", 
"javaType": "java.lang.String", "deprecated": false, "autowired": false, 
"secret": false, "description": "The filterPath will be used by the 
CrossOriginFilter, if the crosssOriginFilterOn is true" },
+    "interval": { "index": 8, "kind": "parameter", "displayName": "Interval", 
"group": "common", "label": "", "required": false, "type": "integer", 
"javaType": "int", "deprecated": false, "autowired": false, "secret": false, 
"description": "The client side poll timeout in milliseconds. How long a client 
will wait between reconnects" },
+    "jsonCommented": { "index": 9, "kind": "parameter", "displayName": "Json 
Commented", "group": "common", "label": "", "required": false, "type": 
"boolean", "javaType": "boolean", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": true, "description": "If true, the server will 
accept JSON wrapped in a comment and will generate JSON wrapped in a comment. 
This is a defence against Ajax Hijacking." },
+    "logLevel": { "index": 10, "kind": "parameter", "displayName": "Log 
Level", "group": "common", "label": "", "required": false, "type": "enum", 
"javaType": "int", "enum": [ "0", "1", "2" ], "deprecated": false, "autowired": 
false, "secret": false, "defaultValue": 1, "description": "Logging level. 
0=none, 1=info, 2=debug." },
+    "maxInterval": { "index": 11, "kind": "parameter", "displayName": "Max 
Interval", "group": "common", "label": "", "required": false, "type": 
"integer", "javaType": "int", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 30000, "description": "The max client side 
poll timeout in milliseconds. A client will be removed if a connection is not 
received in this time." },
+    "multiFrameInterval": { "index": 12, "kind": "parameter", "displayName": 
"Multi Frame Interval", "group": "common", "label": "", "required": false, 
"type": "integer", "javaType": "int", "deprecated": false, "autowired": false, 
"secret": false, "defaultValue": 1500, "description": "The client side poll 
timeout, if multiple connections are detected from the same browser." },
+    "timeout": { "index": 13, "kind": "parameter", "displayName": "Timeout", 
"group": "common", "label": "", "required": false, "type": "integer", 
"javaType": "int", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": 240000, "description": "The server side poll timeout in 
milliseconds. This is how long the server will hold a reconnect request before 
responding." },
+    "sessionHeadersEnabled": { "index": 14, "kind": "parameter", 
"displayName": "Session Headers Enabled", "group": "consumer", "label": 
"consumer", "required": false, "type": "boolean", "javaType": "boolean", 
"deprecated": false, "autowired": false, "secret": false, "defaultValue": 
false, "description": "Whether to include the server session headers in the 
Camel message when creating a Camel Message for incoming requests." },
+    "bridgeErrorHandler": { "index": 15, "kind": "parameter", "displayName": 
"Bridge Error Handler", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "boolean", "javaType": 
"boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "Allows for bridging the consumer to the 
Camel routing Error Handler, which mean any exceptions (if possible) occurred 
while the Camel consumer is trying to pickup incoming [...]
+    "exceptionHandler": { "index": 16, "kind": "parameter", "displayName": 
"Exception Handler", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "object", "javaType": 
"org.apache.camel.spi.ExceptionHandler", "optionalPrefix": "consumer.", 
"deprecated": false, "autowired": false, "secret": false, "description": "To 
let the consumer use a custom ExceptionHandler. Notice if the option 
bridgeErrorHandler is enabled then this option is not in use. By de [...]
+    "exchangePattern": { "index": 17, "kind": "parameter", "displayName": 
"Exchange Pattern", "group": "consumer (advanced)", "label": 
"consumer,advanced", "required": false, "type": "enum", "javaType": 
"org.apache.camel.ExchangePattern", "enum": [ "InOnly", "InOut" ], 
"deprecated": false, "autowired": false, "secret": false, "description": "Sets 
the exchange pattern when the consumer creates an exchange." },
+    "disconnectLocalSession": { "index": 18, "kind": "parameter", 
"displayName": "Disconnect Local Session", "group": "producer", "label": 
"producer", "required": false, "type": "boolean", "javaType": "boolean", 
"deprecated": false, "autowired": false, "secret": false, "defaultValue": 
false, "description": "Whether to disconnect local sessions after publishing a 
message to its channel. Disconnecting local session is needed as they are not 
swept by default by CometD, and therefore you can [...]
+    "lazyStartProducer": { "index": 19, "kind": "parameter", "displayName": 
"Lazy Start Producer", "group": "producer (advanced)", "label": 
"producer,advanced", "required": false, "type": "boolean", "javaType": 
"boolean", "deprecated": false, "autowired": false, "secret": false, 
"defaultValue": false, "description": "Whether the producer should be started 
lazy (on the first message). By starting lazy you can use this to allow 
CamelContext and routes to startup in situations where a produ [...]
+    "headerFilterStrategy": { "index": 20, "kind": "parameter", "displayName": 
"Header Filter Strategy", "group": "advanced", "label": "advanced", "required": 
false, "type": "object", "javaType": 
"org.apache.camel.spi.HeaderFilterStrategy", "deprecated": false, "autowired": 
false, "secret": false, "description": "To use a custom HeaderFilterStrategy to 
filter headers." }
   }
 }
diff --git a/components/camel-cometd/src/main/docs/cometd-component.adoc 
b/components/camel-cometd/src/main/docs/cometd-component.adoc
index 0e78ae0c3941..8a26cd30d024 100644
--- a/components/camel-cometd/src/main/docs/cometd-component.adoc
+++ b/components/camel-cometd/src/main/docs/cometd-component.adoc
@@ -88,6 +88,21 @@ of that channel:
             uri: cometd://0.0.0.0:9099/channel/orders
 ----
 
+=== Allowed Transports and JSONP
+
+By default, the CometD server allows `websocket` and `long-polling` transports 
(`allowedTransports=websocket,long-polling`),
+disabling the legacy JSONP (`callback-polling`) transport mechanism.
+
+To allow JSONP clients, configure `allowedTransports` explicitly on the 
endpoint URI:
+
+[source,text]
+----
+cometd://localhost:8080/service/mychannel?allowedTransports=websocket,long-polling,callback-polling
+----
+
+Because `allowedTransports` configures the underlying Bayeux server for a 
given host and port, the setting applies to
+all endpoints sharing that server.
+
 === Authentication
 
 You can configure custom `SecurityPolicy` and `Extension`'s to the
diff --git 
a/components/camel-cometd/src/main/java/org/apache/camel/component/cometd/CometdComponent.java
 
b/components/camel-cometd/src/main/java/org/apache/camel/component/cometd/CometdComponent.java
index 9c39f3d13af2..6cc840c5afa8 100644
--- 
a/components/camel-cometd/src/main/java/org/apache/camel/component/cometd/CometdComponent.java
+++ 
b/components/camel-cometd/src/main/java/org/apache/camel/component/cometd/CometdComponent.java
@@ -18,12 +18,14 @@ package org.apache.camel.component.cometd;
 
 import java.net.URL;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.EnumSet;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.concurrent.locks.Lock;
 import java.util.concurrent.locks.ReentrantLock;
+import java.util.stream.Collectors;
 
 import jakarta.servlet.DispatcherType;
 
@@ -235,6 +237,13 @@ public class CometdComponent extends DefaultComponent 
implements SSLContextParam
         holder.setInitParameter("multiFrameInterval", 
Integer.toString(endpoint.getMultiFrameInterval()));
         holder.setInitParameter("JSONCommented", 
Boolean.toString(endpoint.isJsonCommented()));
         holder.setInitParameter("logLevel", 
Integer.toString(endpoint.getLogLevel()));
+        if (endpoint.getAllowedTransports() != null) {
+            String transports = 
Arrays.stream(endpoint.getAllowedTransports().split(","))
+                    .map(String::trim)
+                    .filter(s -> !s.isEmpty())
+                    .collect(Collectors.joining(","));
+            holder.setInitParameter("allowedTransports", transports);
+        }
 
         return servlet;
     }
diff --git 
a/components/camel-cometd/src/main/java/org/apache/camel/component/cometd/CometdEndpoint.java
 
b/components/camel-cometd/src/main/java/org/apache/camel/component/cometd/CometdEndpoint.java
index 8cbf8c62edb4..e0a3c215dfbc 100644
--- 
a/components/camel-cometd/src/main/java/org/apache/camel/component/cometd/CometdEndpoint.java
+++ 
b/components/camel-cometd/src/main/java/org/apache/camel/component/cometd/CometdEndpoint.java
@@ -92,6 +92,8 @@ public class CometdEndpoint extends DefaultEndpoint 
implements EndpointServiceLo
     private boolean crossOriginFilterOn;
     @UriParam(defaultValue = "*")
     private String allowedOrigins;
+    @UriParam(defaultValue = "websocket,long-polling")
+    private String allowedTransports = "websocket,long-polling";
     @UriParam
     private String filterPath;
     @UriParam(label = "producer")
@@ -292,6 +294,19 @@ public class CometdEndpoint extends DefaultEndpoint 
implements EndpointServiceLo
         return filterPath;
     }
 
+    public String getAllowedTransports() {
+        return allowedTransports;
+    }
+
+    /**
+     * A comma-separated list of transport names allowed by the CometD server 
(e.g. websocket, long-polling,
+     * callback-polling). callback-polling is the JSONP transport mechanism. 
This option applies to the shared CometD
+     * server on the host and port; the first endpoint to configure the server 
sets this value.
+     */
+    public void setAllowedTransports(String allowedTransports) {
+        this.allowedTransports = allowedTransports;
+    }
+
     /**
      * The filterPath will be used by the CrossOriginFilter, if the 
crosssOriginFilterOn is true
      */
diff --git 
a/components/camel-cometd/src/test/java/org/apache/camel/component/cometd/CometdAllowedTransportsTest.java
 
b/components/camel-cometd/src/test/java/org/apache/camel/component/cometd/CometdAllowedTransportsTest.java
new file mode 100644
index 000000000000..a1922a0bef6b
--- /dev/null
+++ 
b/components/camel-cometd/src/test/java/org/apache/camel/component/cometd/CometdAllowedTransportsTest.java
@@ -0,0 +1,104 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.cometd;
+
+import java.net.URI;
+import java.net.URLEncoder;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.charset.StandardCharsets;
+
+import org.apache.camel.builder.RouteBuilder;
+import org.apache.camel.test.AvailablePortFinder;
+import org.apache.camel.test.junit6.CamelTestSupport;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+public class CometdAllowedTransportsTest extends CamelTestSupport {
+
+    @RegisterExtension
+    AvailablePortFinder.Port defaultTransportsPort = 
AvailablePortFinder.find();
+    @RegisterExtension
+    AvailablePortFinder.Port customTransportsPort = AvailablePortFinder.find();
+
+    @Test
+    void testDefaultTransportsRejectsJsonp() throws Exception {
+        HttpResponse<String> response = 
sendJsonpHandshake(defaultTransportsPort.getPort());
+        // Default allowedTransports is "websocket,long-polling", so JSONP 
(callback-polling) is rejected
+        assertEquals(400, response.statusCode());
+        assertFalse(response.body().contains("\"successful\":true"));
+    }
+
+    @Test
+    void testDefaultTransportsAllowsLongPolling() throws Exception {
+        HttpResponse<String> response = 
sendLongPollingHandshake(defaultTransportsPort.getPort());
+        assertEquals(200, response.statusCode());
+        assertTrue(response.body().contains("\"successful\":true"));
+        assertFalse(response.body().contains("callback-polling"));
+    }
+
+    @Test
+    void testCustomTransportsAllowsJsonpWhenConfigured() throws Exception {
+        HttpResponse<String> response = 
sendJsonpHandshake(customTransportsPort.getPort());
+        assertEquals(200, response.statusCode());
+        assertTrue(response.body().contains("cb(["));
+        assertTrue(response.body().contains("\"successful\":true"));
+    }
+
+    private HttpResponse<String> sendJsonpHandshake(int port) throws Exception 
{
+        String msg
+                = 
"[{\"channel\":\"/meta/handshake\",\"version\":\"1.0\",\"supportedConnectionTypes\":[\"callback-polling\"]}]";
+        String encodedMsg = URLEncoder.encode(msg, StandardCharsets.UTF_8);
+        HttpRequest request = HttpRequest.newBuilder(
+                URI.create("http://127.0.0.1:"; + port + 
"/cometd/handshake?jsonp=cb&message=" + encodedMsg))
+                .GET()
+                .build();
+        try (HttpClient client = HttpClient.newHttpClient()) {
+            return client.send(request, HttpResponse.BodyHandlers.ofString());
+        }
+    }
+
+    private HttpResponse<String> sendLongPollingHandshake(int port) throws 
Exception {
+        HttpRequest request = 
HttpRequest.newBuilder(URI.create("http://127.0.0.1:"; + port + 
"/cometd/handshake"))
+                .POST(HttpRequest.BodyPublishers.ofString(
+                        
"[{\"channel\":\"/meta/handshake\",\"version\":\"1.0\",\"supportedConnectionTypes\":[\"long-polling\"]}]"))
+                .header("Content-Type", "application/json")
+                .build();
+        try (HttpClient client = HttpClient.newHttpClient()) {
+            return client.send(request, HttpResponse.BodyHandlers.ofString());
+        }
+    }
+
+    @Override
+    protected RouteBuilder createRouteBuilder() {
+        return new RouteBuilder() {
+            @Override
+            public void configure() {
+                from("cometd://127.0.0.1:" + defaultTransportsPort.getPort() + 
"/service/test")
+                        .to("mock:default");
+                from("cometd://127.0.0.1:" + customTransportsPort.getPort()
+                     + "/service/custom?allowedTransports=websocket, 
long-polling, callback-polling")
+                        .to("mock:custom");
+            }
+        };
+    }
+}
diff --git 
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc 
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
index 32f58f99964e..20c81b3f9229 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
@@ -3725,6 +3725,13 @@ the YAML DSL validator and the Endpoint DSL, now accept 
a whatsapp endpoint as a
 of whatsapp gets the consumer options `bridgeErrorHandler`, `exceptionHandler` 
and `exchangePattern`. A whatsapp
 endpoint used directly in `from` still fails at startup: wrap it with the 
webhook component, as before.
 
+=== camel-cometd - the JSONP transport is disabled by default
+
+The CometD JSONP transport (`callback-polling`) is now disabled by default. 
Only `long-polling` (and `websocket`,
+when the CometD WebSocket transport is on the classpath) is enabled by 
default. Applications that require JSONP
+clients can configure `allowedTransports` on the endpoint to include 
`callback-polling`
+(for example, `allowedTransports=websocket,long-polling,callback-polling`).
+
 === camel-avro-rpc - the http consumer listens on the host of the endpoint
 
 The `avro:http` consumer now uses the host of the endpoint URI 
(`avro:http:[host]:[port]`) for its HTTP server, as the `avro:netty` consumer 
does.
diff --git 
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/CometdEndpointBuilderFactory.java
 
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/CometdEndpointBuilderFactory.java
index 8945cc2b8487..72b5365844db 100644
--- 
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/CometdEndpointBuilderFactory.java
+++ 
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/CometdEndpointBuilderFactory.java
@@ -60,6 +60,25 @@ public interface CometdEndpointBuilderFactory {
             doSetProperty("allowedOrigins", allowedOrigins);
             return this;
         }
+        /**
+         * A comma-separated list of transport names allowed by the CometD
+         * server (e.g. websocket, long-polling, callback-polling).
+         * callback-polling is the JSONP transport mechanism. This option
+         * applies to the shared CometD server on the host and port; the first
+         * endpoint to configure the server sets this value.
+         * 
+         * The option is a: <code>java.lang.String</code> type.
+         * 
+         * Default: websocket,long-polling
+         * Group: common
+         * 
+         * @param allowedTransports the value to set
+         * @return the dsl builder
+         */
+        default CometdEndpointConsumerBuilder allowedTransports(String 
allowedTransports) {
+            doSetProperty("allowedTransports", allowedTransports);
+            return this;
+        }
         /**
          * The root directory for the web resources or classpath. Use the
          * protocol file: or classpath: depending if you want that the 
component
@@ -531,6 +550,25 @@ public interface CometdEndpointBuilderFactory {
             doSetProperty("allowedOrigins", allowedOrigins);
             return this;
         }
+        /**
+         * A comma-separated list of transport names allowed by the CometD
+         * server (e.g. websocket, long-polling, callback-polling).
+         * callback-polling is the JSONP transport mechanism. This option
+         * applies to the shared CometD server on the host and port; the first
+         * endpoint to configure the server sets this value.
+         * 
+         * The option is a: <code>java.lang.String</code> type.
+         * 
+         * Default: websocket,long-polling
+         * Group: common
+         * 
+         * @param allowedTransports the value to set
+         * @return the dsl builder
+         */
+        default CometdEndpointProducerBuilder allowedTransports(String 
allowedTransports) {
+            doSetProperty("allowedTransports", allowedTransports);
+            return this;
+        }
         /**
          * The root directory for the web resources or classpath. Use the
          * protocol file: or classpath: depending if you want that the 
component
@@ -933,6 +971,25 @@ public interface CometdEndpointBuilderFactory {
             doSetProperty("allowedOrigins", allowedOrigins);
             return this;
         }
+        /**
+         * A comma-separated list of transport names allowed by the CometD
+         * server (e.g. websocket, long-polling, callback-polling).
+         * callback-polling is the JSONP transport mechanism. This option
+         * applies to the shared CometD server on the host and port; the first
+         * endpoint to configure the server sets this value.
+         * 
+         * The option is a: <code>java.lang.String</code> type.
+         * 
+         * Default: websocket,long-polling
+         * Group: common
+         * 
+         * @param allowedTransports the value to set
+         * @return the dsl builder
+         */
+        default CometdEndpointBuilder allowedTransports(String 
allowedTransports) {
+            doSetProperty("allowedTransports", allowedTransports);
+            return this;
+        }
         /**
          * The root directory for the web resources or classpath. Use the
          * protocol file: or classpath: depending if you want that the 
component

Reply via email to