Claus Ibsen created CAMEL-25993:
-----------------------------------
Summary: camel-cometd - turn on the JSONP transport only when
asked for, and do not allow credentials for the null origin
Key: CAMEL-25993
URL: https://issues.apache.org/jira/browse/CAMEL-25993
Project: Camel
Issue Type: Improvement
Components: camel-cometd
Reporter: Claus Ibsen
Fix For: 4.24.0
The CometD server that camel-cometd creates
(CometdComponent.createServletForConnector) sets no {{transports}} or
{{allowedTransports}} init parameter, so CometD turns on every HTTP transport
it has: {{long-polling}} and {{callback-polling}} (JSONP). Checked on
4.24.0-SNAPSHOT with CometD 9.0.1: {{BayeuxServerImpl.getAllowedTransports()}}
returns {{[long-polling, callback-polling]}}.
JSONP is a legacy transport for browsers without CORS support. The cross-origin
options of the endpoint ({{crossOriginFilterOn}}, {{allowedOrigins}}) only
apply to XHR/fetch requests, so they have no effect on clients that use JSONP.
Few users need JSONP today, so it should be something a user turns on.
A related detail from CAMEL-25984: with {{allowedOrigins=null}}, the filter
answers {{Origin: null}} with {{Access-Control-Allow-Credentials: true}}. Any
sandboxed iframe sends {{Origin: null}}, so {{null}} should be treated like a
wildcard: allowed, but without credentials.
*Proposed change*
* Configure the CometD servlet with {{allowedTransports=long-polling}} by
default, and add an endpoint option to turn JSONP ({{callback-polling}}) back
on.
* Treat {{null}} in {{allowedOrigins}} like a wildcard when deciding
{{allowCredentials}}.
* Upgrade guide note for 4.24: clients that use the JSONP transport need the
new option.
* Tests for both.
Main only, as it changes a default.
_Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
