Federico Mariani created CAMEL-25984:
----------------------------------------
Summary: camel-cometd - CORS filter should not allow credentials
for wildcard origins
Key: CAMEL-25984
URL: https://issues.apache.org/jira/browse/CAMEL-25984
Project: Camel
Issue Type: Bug
Components: camel-cometd
Reporter: Federico Mariani
Assignee: Federico Mariani
Fix For: 4.24.0, 4.22.3, 4.18.6
With {{crossOriginFilterOn=true}}, {{CometdComponent}} installs Jetty's
{{CrossOriginFilter}} and sets only {{allowedOrigins}}. {{allowCredentials}} is
left at the Jetty default ({{true}}), so with {{allowedOrigins}} unset or {{*}}
(the default) responses carry {{Access-Control-Allow-Credentials: true}} for
any origin.
Proposed change: always set {{allowCredentials}} on the filter, {{true}} only
when {{allowedOrigins}} lists specific origins (no entry containing {{*}}),
{{false}} otherwise. Cross-origin requests without credentials keep working.
Includes a test and a note in the 4.24 upgrade guide.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
