[
https://issues.apache.org/jira/browse/CAMEL-25568?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18127390#comment-18127390
]
Andrea Cosentino commented on CAMEL-25568:
------------------------------------------
Upgrade guide notes for the backports merged on main:
https://github.com/apache/camel/pull/27864 (camel-oauth note added to the
4.22.1 to 4.22.2 and 4.18.5 to 4.18.6 sections).
_camel-f9 (Claude Code on behalf of oscerd)_
> camel-oauth - make OAuthBearerTokenProcessor stateless and read credentials
> from HTTP request headers
> -----------------------------------------------------------------------------------------------------
>
> Key: CAMEL-25568
> URL: https://issues.apache.org/jira/browse/CAMEL-25568
> Project: Camel
> Issue Type: Improvement
> Components: camel-oauth
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.18.6, 4.22.2, 4.24.0
>
>
> {{OAuthBearerTokenProcessor}} and {{InMemorySessionStore}} read request
> credentials from the Camel message header map:
> * {{OAuthBearerTokenProcessor}} reads the bearer token with
> {{msg.getHeader("Authorization")}}.
> * {{InMemorySessionStore.getSession()}} reads the session id from the
> {{Cookie}} message header.
> HTTP consumers such as platform-http and servlet also map query and form
> parameters into that header map, so these values are not guaranteed to come
> from the corresponding HTTP request headers. RFC 6750 section 2.1 defines the
> {{Authorization}} request header as the bearer token transport.
> In addition, {{OAuthBearerTokenProcessor}} calls
> {{OAuth.getOrCreateSession()}} and {{OAuthSession.putUserProfile()}} after
> authenticating a token, so a per-request bearer authentication creates or
> updates a camel-oauth session and may emit a {{camel.oauth.session}} cookie.
> Proposal:
> * Read {{Authorization}} and {{Cookie}} from the underlying HTTP request
> headers when the message carries the HTTP request (platform-http on Vert.x,
> servlet), as the {{oauthProfile}} integrations in camel-servlet, camel-jetty,
> camel-netty-http and camel-undertow already do for {{Authorization}}.
> * Make {{OAuthBearerTokenProcessor}} stateless: do not create or update an
> {{OAuthSession}} and do not set a cookie; expose the authenticated
> {{UserProfile}} on the exchange instead.
> Routes that read the user profile from the OAuth session after
> {{OAuthBearerTokenProcessor}} need to read it from the exchange instead, so
> this needs an upgrade-guide entry.
> _Claude Code on behalf of oscerd_
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
