[
https://issues.apache.org/jira/browse/CAMEL-25994?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18130335#comment-18130335
]
Claus Ibsen commented on CAMEL-25994:
-------------------------------------
PR: https://github.com/apache/camel/pull/28297
_Claude Code on behalf of davsclaus_
> camel-undertow - WebSocket: keep the OAuth validation of a connection per
> endpoint, like the other security checks
> ------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-25994
> URL: https://issues.apache.org/jira/browse/CAMEL-25994
> Project: Camel
> Issue Type: Bug
> Components: camel-undertow
> Reporter: Claus Ibsen
> Assignee: Claus Ibsen
> Priority: Minor
> Fix For: 4.22.3, 4.24.0
>
>
> {{CamelWebSocketHandler}} records, for each WebSocket connection, which
> endpoints of the path the handshake was checked against: the security
> provider, the allowed roles and the custom handlers of a consumer are all
> kept per endpoint URI. The result of the {{oauthProfile}} validation is kept
> on the connection without the endpoint that did the validation, so later
> checks of an open connection only see that some OAuth validation happened.
> *Proposed change*: record the OAuth validation per endpoint, like the other
> checks, and check an open connection against the endpoints whose settings
> currently apply to the path. Add tests where the consumer of a path changes
> while connections are open.
> _Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
