Andrea Cosentino created CAMEL-24500:
----------------------------------------
Summary: camel-debug-starter - debugger and JMX connector are both
enabled by default on classpath presence
Key: CAMEL-24500
URL: https://issues.apache.org/jira/browse/CAMEL-24500
Project: Camel
Issue Type: Improvement
Components: camel-spring-boot-starters
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
{{CamelDebugConfigurationProperties}} defaults both the debugger and its JMX
RMI connector to on:
{code:java}
private boolean enabled = true;
...
private boolean jmxConnectorEnabled = true;
...
@Metadata(label = "advanced", defaultValue = "1099")
private int jmxConnectorPort = 1099;
{code}
(CamelDebugConfigurationProperties:29, 108, 114)
{{standby}} defaults to false, so adding the starter to the classpath both
installs the debugger and opens a listening RMI socket on 1099, with no
authentication configured on the connector. The equivalent camel-main option
defaults to disabled.
The starter is a development tool and is expected to be added deliberately, but
the JMX connector opening a socket is a second effect beyond enabling the
debugger itself, and it is not obvious from the property name that adding the
starter starts a listener.
*Proposal*
- Default {{jmxConnectorEnabled}} to false so the socket is opened only when
explicitly requested, or
- default {{enabled}} to false / {{standby}} to true, matching camel-main.
- Document that the connector is unauthenticated and should be bound or
firewalled accordingly.
Whichever default changes, it belongs in the upgrade guide.
----
_This issue was drafted by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
