Andrea Cosentino created CAMEL-26068:
----------------------------------------
Summary: camel-netty-http - Ensure NettyHttpSecurityConfiguration
is copied per endpoint
Key: CAMEL-26068
URL: https://issues.apache.org/jira/browse/CAMEL-26068
Project: Camel
Issue Type: Bug
Components: camel-netty-http
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.24.0, 4.22.3, 4.18.6
h3. Current behaviour
In
{{org.apache.camel.component.netty.http.NettyHttpComponent.createEndpoint(...)}}
(camel-netty-http), when {{NettyHttpSecurityConfiguration}} is configured on
the component, endpoints receive the shared component-level instance directly
without copying.
When an endpoint specifies {{securityConfiguration.*}} URI parameters,
{{setProperties(securityConfiguration, securityOptions)}} modifies the shared
instance held by the endpoint in place.
As a result, modifying {{securityConfiguration}} parameters on one endpoint
mutates the component's shared configuration, affecting other endpoints that
use the component configuration.
h3. Expected behaviour
{{NettyHttpSecurityConfiguration}} should implement {{Cloneable}} and provide a
{{copy()}} method.
{{NettyHttpComponent.createEndpoint(...)}} should assign an independent copy of
{{NettyHttpSecurityConfiguration}} to each endpoint (similar to how
{{NettyHttpConfiguration}} and {{NettyHttpBinding}} are copied) so that
endpoint-level configuration options do not alter the shared component
configuration or other endpoints.
h3. Change
* {{org.apache.camel.component.netty.http.NettyHttpSecurityConfiguration}}:
Implement {{Cloneable}} and provide a {{copy()}} method.
* {{org.apache.camel.component.netty.http.NettyHttpComponent}}: In
{{createEndpoint(...)}}, set a copy of the security configuration on the
endpoint before applying any URI-level {{securityOptions}}.
* Add unit tests in camel-netty-http to verify endpoint configuration isolation.
h3. Tests
* Add unit test verifying that setting endpoint-specific
{{securityConfiguration}} options does not mutate the component-level instance
or sibling endpoints.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
