Andrea Cosentino created CAMEL-25638:
----------------------------------------
Summary: camel-graphql - bind accessToken and basic credentials to
the configured httpUri authority
Key: CAMEL-25638
URL: https://issues.apache.org/jira/browse/CAMEL-25638
Project: Camel
Issue Type: Bug
Components: camel-graphql
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.24.0, 4.18.6, 4.22.2
camel-graphql configures authentication on its HTTP client itself, so the
authority scoping that CAMEL-24452 added to camel-http does not apply to it:
* {{accessToken}} (with {{jwtAuthorizationType}}) is installed with
{{HttpClientBuilder.setDefaultHeaders(...)}}, so the {{Authorization}} header
is added to every request the client executes, whatever its authority.
* {{username}}/{{password}} are registered under {{new AuthScope(null, -1)}},
which matches any scheme, host and port.
Align it with camel-http:
* register the basic credentials for the scheme, host and effective port of
{{httpUri}};
* attach the access token from a request interceptor, only when the request
targets that authority (as {{OAuth2ClientConfigurer}} does since CAMEL-24452).
Since CAMEL-22562 (4.19.0) the producer copies every message header into the
internal camel-http exchange, so {{CamelHttpUri}}, {{CamelHttpPath}},
{{CamelHttpQuery}} and {{CamelRestHttpUri}} now change the request URL, which
camel-graphql did not do before. The internal endpoint should be created with
{{skipControlHeaders=true}} so that the producer always addresses its
configured {{httpUri}}.
On camel-4.18.x the code is {{GraphqlEndpoint.createHttpClient()}} (the
component builds its own client there), so the backport is a port rather than a
cherry-pick.
_Claude Code on behalf of oscerd_
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
