Andrea Cosentino created CAMEL-24453:
----------------------------------------
Summary: camel-platform-http - request-header echo suppression
compares header names case-sensitively
Key: CAMEL-24453
URL: https://issues.apache.org/jira/browse/CAMEL-24453
Project: Camel
Issue Type: Bug
Components: camel-platform-http
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.23.0
{{PlatformHttpEndpoint.enhanceHeaderFilterStrategyToSkipHttpRequestHeaders()}}
wraps the endpoint's {{HeaderFilterStrategy}} so that request headers are not
echoed back on the response. Its {{applyFilterToCamelHeaders}} returns true
only when {{COMMON_HTTP_REQUEST_HEADERS.contains(headerName)}} - an exact-case
lookup against a canonically capitalised set ({{"Authorization"}},
{{"Cookie"}}, ...).
Exchange headers keep the casing of the inbound request:
{{VertxPlatformHttpConsumer}} populates them from the Vert.x {{MultiMap}} as
received. HTTP/2 mandates lower-case field names, so on an HTTP/2 request the
names are {{authorization}}, {{cookie}} and so on, none of which match the set.
{{VertxPlatformHttpSupport.copyMessageHeadersToResponse}} then writes them to
the response.
The suppression therefore never fires for HTTP/2 traffic, and does not fire for
any client that varies the casing.
Proposal: compare case-insensitively - a {{TreeSet}} with
{{String.CASE_INSENSITIVE_ORDER}}, or lower-case both sides at the lookup.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
