[
https://issues.apache.org/jira/browse/CAMEL-25984?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen resolved CAMEL-25984.
---------------------------------
Resolution: Fixed
Merged: main #28283 + upgrade guide #28504, camel-4.22.x #28502, camel-4.18.x
#28503.
_Claude Code on behalf of davsclaus_
> camel-cometd - CORS filter should not allow credentials for wildcard origins
> ----------------------------------------------------------------------------
>
> Key: CAMEL-25984
> URL: https://issues.apache.org/jira/browse/CAMEL-25984
> Project: Camel
> Issue Type: Bug
> Components: camel-cometd
> Reporter: Federico Mariani
> Assignee: Federico Mariani
> Priority: Major
> Fix For: 4.18.6, 4.22.3, 4.24.0
>
>
> With {{crossOriginFilterOn=true}}, {{CometdComponent}} installs Jetty's
> {{CrossOriginFilter}} and sets only {{allowedOrigins}}. {{allowCredentials}}
> is left at the Jetty default ({{true}}), so with {{allowedOrigins}} unset or
> {{*}} (the default) responses carry {{Access-Control-Allow-Credentials:
> true}} for any origin.
> Proposed change: always set {{allowCredentials}} on the filter, {{true}} only
> when {{allowedOrigins}} lists specific origins (no entry containing {{*}}),
> {{false}} otherwise. Cross-origin requests without credentials keep working.
> Includes a test and a note in the 4.24 upgrade guide.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
