Andrea Cosentino created CAMEL-24732:
----------------------------------------
Summary: camel-opa - consider narrowing the default includeHeaders
before 4.23.0 ships
Key: CAMEL-24732
URL: https://issues.apache.org/jira/browse/CAMEL-24732
Project: Camel
Issue Type: Improvement
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
h2. Observation
{{camel-opa}}'s {{includeHeaders}} defaults to {{*}}, so every message header
is copied into the OPA {{input}} document - including {{Authorization}},
{{Cookie}} and any other credential the transport left on the message.
The body is deliberately *not* sent by default ({{includeBody=false}}, on the
grounds that bodies are large and mostly unnecessary for an authorization
decision), so the component already accepts this kind of asymmetry; headers
were defaulted wide because they are the useful signal.
h2. Why it is worth a second look
OPA is a trusted component - it has to be, it makes the decision - but "trusted
to decide" is not the same as "an appropriate destination for every credential
on the message". OPA's *decision logging* is a standard, commonly-enabled
feature that ships the whole {{input}} document to a remote service or to disk.
With the current default, enabling decision logs exports every inbound
{{Authorization}} header out of the JVM, which is not obvious from the route.
This is a judgement call rather than a defect, and the current behaviour is
documented:
{quote}
Narrow it when the policy only needs a few headers, or when the message carries
headers that should not leave the JVM.
{quote}
The reason to raise it now is timing: 4.23.0 has not shipped, so the default
can still be changed without a migration note.
h2. Options
# Leave as-is and strengthen the documentation, calling out OPA decision
logging explicitly as the reason to narrow the list.
# Keep {{*}} but exclude a small set of well-known credential headers
({{Authorization}}, {{Proxy-Authorization}}, {{Cookie}}, {{Set-Cookie}}) unless
named explicitly - the policy can still opt in by listing them.
# Default to an empty allow-list, forcing every route to declare what the
policy sees. Safest, but makes the component useless out of the box and is
probably too strict.
Option 2 keeps the component usable while making the credential case opt-in,
and pairs naturally with {{includeProperties}} (CAMEL-24643), which is the
right channel for a *verified* identity.
h2. Scope
{{main}} only, before 4.23.0. Whichever option is chosen,
{{opa-component.adoc}} needs to state the resulting contract precisely.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
