[
https://issues.apache.org/jira/browse/CAMEL-24732?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-24732 started by Andrea Cosentino.
------------------------------------------------
> camel-opa - consider narrowing the default includeHeaders before 4.23.0 ships
> -----------------------------------------------------------------------------
>
> Key: CAMEL-24732
> URL: https://issues.apache.org/jira/browse/CAMEL-24732
> Project: Camel
> Issue Type: Improvement
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
>
> h2. Observation
> {{camel-opa}}'s {{includeHeaders}} defaults to {{*}}, so every message header
> is copied into the OPA {{input}} document - including {{Authorization}},
> {{Cookie}} and any other credential the transport left on the message.
> The body is deliberately *not* sent by default ({{includeBody=false}}, on the
> grounds that bodies are large and mostly unnecessary for an authorization
> decision), so the component already accepts this kind of asymmetry; headers
> were defaulted wide because they are the useful signal.
> h2. Why it is worth a second look
> OPA is a trusted component - it has to be, it makes the decision - but
> "trusted to decide" is not the same as "an appropriate destination for every
> credential on the message". OPA's *decision logging* is a standard,
> commonly-enabled feature that ships the whole {{input}} document to a remote
> service or to disk. With the current default, enabling decision logs exports
> every inbound {{Authorization}} header out of the JVM, which is not obvious
> from the route.
> This is a judgement call rather than a defect, and the current behaviour is
> documented:
> {quote}
> Narrow it when the policy only needs a few headers, or when the message
> carries headers that should not leave the JVM.
> {quote}
> The reason to raise it now is timing: 4.23.0 has not shipped, so the default
> can still be changed without a migration note.
> h2. Options
> # Leave as-is and strengthen the documentation, calling out OPA decision
> logging explicitly as the reason to narrow the list.
> # Keep {{*}} but exclude a small set of well-known credential headers
> ({{Authorization}}, {{Proxy-Authorization}}, {{Cookie}}, {{Set-Cookie}})
> unless named explicitly - the policy can still opt in by listing them.
> # Default to an empty allow-list, forcing every route to declare what the
> policy sees. Safest, but makes the component useless out of the box and is
> probably too strict.
> Option 2 keeps the component usable while making the credential case opt-in,
> and pairs naturally with {{includeProperties}} (CAMEL-24643), which is the
> right channel for a *verified* identity.
> h2. Scope
> {{main}} only, before 4.23.0. Whichever option is chosen,
> {{opa-component.adoc}} needs to state the resulting contract precisely.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
