[
https://issues.apache.org/jira/browse/CAMEL-25568?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen resolved CAMEL-25568.
---------------------------------
Resolution: Fixed
> camel-oauth - make OAuthBearerTokenProcessor stateless and read credentials
> from HTTP request headers
> -----------------------------------------------------------------------------------------------------
>
> Key: CAMEL-25568
> URL: https://issues.apache.org/jira/browse/CAMEL-25568
> Project: Camel
> Issue Type: Improvement
> Components: camel-oauth
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.18.6, 4.22.2, 4.24.0
>
>
> {{OAuthBearerTokenProcessor}} and {{InMemorySessionStore}} read request
> credentials from the Camel message header map:
> * {{OAuthBearerTokenProcessor}} reads the bearer token with
> {{msg.getHeader("Authorization")}}.
> * {{InMemorySessionStore.getSession()}} reads the session id from the
> {{Cookie}} message header.
> HTTP consumers such as platform-http and servlet also map query and form
> parameters into that header map, so these values are not guaranteed to come
> from the corresponding HTTP request headers. RFC 6750 section 2.1 defines the
> {{Authorization}} request header as the bearer token transport.
> In addition, {{OAuthBearerTokenProcessor}} calls
> {{OAuth.getOrCreateSession()}} and {{OAuthSession.putUserProfile()}} after
> authenticating a token, so a per-request bearer authentication creates or
> updates a camel-oauth session and may emit a {{camel.oauth.session}} cookie.
> Proposal:
> * Read {{Authorization}} and {{Cookie}} from the underlying HTTP request
> headers when the message carries the HTTP request (platform-http on Vert.x,
> servlet), as the {{oauthProfile}} integrations in camel-servlet, camel-jetty,
> camel-netty-http and camel-undertow already do for {{Authorization}}.
> * Make {{OAuthBearerTokenProcessor}} stateless: do not create or update an
> {{OAuthSession}} and do not set a cookie; expose the authenticated
> {{UserProfile}} on the exchange instead.
> Routes that read the user profile from the OAuth session after
> {{OAuthBearerTokenProcessor}} need to read it from the exchange instead, so
> this needs an upgrade-guide entry.
> _Claude Code on behalf of oscerd_
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
