Joshua Grisham created CAMEL-20498:
--------------------------------------
Summary: camel-http OAuth2 support is not adding the text "Bearer
" to the Authorization header
Key: CAMEL-20498
URL: https://issues.apache.org/jira/browse/CAMEL-20498
Project: Camel
Issue Type: Bug
Components: camel-http
Affects Versions: 4.4.0
Reporter: Joshua Grisham
When using the OAuth2 support for camel-http, it is not adding the prefix text
"Bearer " before the access token in the Authorization header as per the OAuth2
specification: [https://datatracker.ietf.org/doc/html/rfc6750#section-2.1]
In the end it does not actually work to use this feature at all from what I can
see – the header is not considered valid for an OAuth2 access token and when
trying to use this against a real API that requires a token then you receive
back an authorization failure.
When turning on DEBUG logging you can see that the access token is fetched
correctly but then on the request it is being sent without the text "Bearer "
in front of the token:
{code:java}
http-outgoing-0 >> "Authorization: eyJhbG..." {code}
>From a quick skim in the code it seems like the problem lies here:
>https://github.com/apache/camel/blob/e8ea7ab337cee460858d44968c50dbfafa22ef28/components/camel-http/src/main/java/org/apache/camel/component/http/OAuth2ClientConfigurer.java#L64
That is to say, the code is just adding the "Authorization" header where the
value is only the access token itself, and not adding the text "Bearer " before
the token as per the OAuth2 specification.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
