This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 2d97a2141484 CAMEL-26281: Sync the camel-whatsapp webhook upgrade
guide notes for 4.22.3 and 4.18.6 to main (#29280)
2d97a2141484 is described below
commit 2d97a2141484dba15316db667420ddba5deb0d41
Author: Claus Ibsen <[email protected]>
AuthorDate: Thu Nov 5 21:23:23 2026 +0100
CAMEL-26281: Sync the camel-whatsapp webhook upgrade guide notes for 4.22.3
and 4.18.6 to main (#29280)
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: Claus Ibsen <[email protected]>
---
.../modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc | 13 +++++++++++++
.../modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc | 12 ++++++++++++
2 files changed, 25 insertions(+)
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
index a1452a563530..8f1d382ee8da 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
@@ -207,6 +207,19 @@ registered.
To restore the previous behaviour, set `webhookSecretTokenEnabled=false`: the
webhook is then registered without a
secret token, and webhook requests are not verified.
+=== camel-whatsapp - webhook events are verified by default
+
+In webhook mode (`webhook:whatsapp:...`), the `X-Hub-Signature-256` signature
of every event that WhatsApp posts is now
+verified with the `webhookSecret` option (added in 4.18.3), the app secret
from the Meta app dashboard. Before, the
+signature was only verified when `webhookSecret` was set. A webhook route
without `webhookSecret` now fails to start.
+Set `webhookSecret` to the app secret, or set the new `webhookVerification`
option to `false` to accept the events
+without verifying their signature, for example in development. An event
without a valid signature is answered with HTTP
+403 and does not reach the route. A client that posts events to the webhook
endpoint directly, for example in a test,
+must sign them too.
+
+An event that reaches the route is now answered with HTTP 200 and an empty
body. Before, the reply carried the event
+back to the caller. The reply to the verification request (`GET`) is still the
`hub.challenge`.
+
=== camel-thrift - SSL/TLS settings of the consumer, and errors sent to the
client
* A consumer configured with `negotiationType=SSL` and the default
`synchronous=false` now fails to start. It used to
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
index ee9861f502ce..5e943dbb99c4 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
@@ -142,6 +142,18 @@ to the HTTP server and the HTTP management server of
camel-platform-http-main (`
the failure was only logged at WARN, and Camel started, with its platform-http
routes reported as started, although
nothing listened on the port.
+=== camel-whatsapp - webhook events are verified by default
+
+In webhook mode (`webhook:whatsapp:...`), the `X-Hub-Signature-256` signature
of every event that WhatsApp posts is now
+verified with the `webhookSecret` option, the app secret from the Meta app
dashboard. Before, the signature was only
+verified when `webhookSecret` was set. A webhook route without `webhookSecret`
now fails to start. Set `webhookSecret`
+to the app secret, or set the new `webhookVerification` option to `false` to
accept the events without verifying their
+signature, for example in development. An event without a valid signature is
answered with HTTP 403 and does not reach
+the route. A client that posts events to the webhook endpoint directly, for
example in a test, must sign them too.
+
+An event that reaches the route is now answered with HTTP 200 and an empty
body. Before, the reply carried the event
+back to the caller. The reply to the verification request (`GET`) is still the
`hub.challenge`.
+
=== camel-elasticsearch - the credentials are only sent to the nodes of the
cluster
The `user` and `password` are now offered only to the nodes the client talks
to: the hosts of `hostAddresses` and,
