oscerd opened a new pull request, #28622: URL: https://github.com/apache/camel/pull/28622
## Backport of #28512 Cherry-pick of #28512 onto `camel-4.18.x`. **Original PR:** #28512 - CAMEL-26319: camel-oauth: InMemorySessionStore should not log session identifiers and OAuthCodeFlowCallback should rotate session identifiers on login **Original author:** @oscerd **Target branch:** `camel-4.18.x` ### Original description Jira: https://issues.apache.org/jira/browse/CAMEL-26319 #### Problem In `InMemorySessionStore.createSession(Exchange)` (camel-oauth), the session identifier is logged at `INFO` level when creating a new session. In addition, during the OAuth authorization code flow, `OAuthCodeFlowCallback.process(Exchange)` binds the authenticated `UserProfile` to the pre-existing session without rotating the session identifier, allowing the pre-authentication identifier to remain valid and active post-login. #### Change - `OAuthSessionStore`: Added default `rotateSession(Exchange exchange, OAuthSession session)` method to support session identifier rotation, including an `@implNote` warning implementors that custom stores must override the method to prevent session fixation. - `OAuth`: Added documented `rotateSession(Exchange exchange, OAuthSession session)` delegating to the session store. - `InMemorySession`: Added package-private `getValues()` and `putAll(...)` helper methods to copy session attributes. - `InMemorySessionStore`: - Avoided session identifier exposure in logs: downgraded `createSession()` logging from `INFO` to `DEBUG`, sanitized `getSession()` `WARN` message when no session is found, and logged rotation at `DEBUG` without session identifiers. - Implemented `rotateSession()` to generate a new session identifier, copy over existing session attributes, invalidate the old session identifier in storage, and issue an updated `Set-Cookie` header and `CamelOAuthSessionId` message header. - `OAuthCodeFlowCallback`: Call `oauth.rotateSession(exchange, session)` upon receiving the authenticated user profile before redirecting to the post-login URL. #### Tests - Added `OAuthCodeFlowSessionRotationTest` in `camel-oauth` to test: - `InMemorySessionStore.rotateSession` replaces the session identifier, migrates existing values, invalidates the old session identifier, and emits an updated session cookie and message header. - `OAuthCodeFlowCallback` rotates the session identifier upon successful authentication, preventing subsequent requests with the pre-login session identifier from executing protected routes, while requests presenting the rotated post-login session identifier execute with the authenticated user profile. - Updated `AbstractOAuthRequestHeadersTest.loginAsBob()` to pick up the updated session cookie emitted by the callback. - All 85 unit and integration tests in `camel-oauth` pass cleanly. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
