Andrea Cosentino created CAMEL-26319:
----------------------------------------
Summary: camel-oauth: InMemorySessionStore should not log session
identifiers and OAuthCodeFlowCallback should rotate session identifiers on login
Key: CAMEL-26319
URL: https://issues.apache.org/jira/browse/CAMEL-26319
Project: Camel
Issue Type: Bug
Components: camel-oauth
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.24.0, 4.22.3, 4.18.6
h3. Current behaviour
In {{org.apache.camel.oauth.InMemorySessionStore.createSession(Exchange)}}
(camel-oauth), the session identifier is logged at INFO level when creating a
new session:
{code:java}
var sessionId = UUID.randomUUID().toString();
var session = new InMemorySession(sessionId);
sessions.put(sessionId, session);
var msg = exchange.getMessage();
log.info("New OAuthSession: {}", sessionId);
setSessionCookie(msg, session);
{code}
In addition, during the authorization code flow,
{{OAuthCodeFlowCallback.process(Exchange)}} retrieves the existing session and
stores the authenticated {{UserProfile}} directly into it without rotating the
session identifier:
{code:java}
var session = oauth.getOrCreateSession(exchange);
...
var userProfile = oauth.authenticate(...);
session.putUserProfile(userProfile);
{code}
As a result, session identifiers appear in standard application logs, and the
pre-authentication session identifier continues to identify the authenticated
session post-login.
h3. Expected behaviour
* {{InMemorySessionStore}} should not emit session identifiers at standard log
levels (INFO/WARN/ERROR).
* {{OAuthCodeFlowCallback}} should rotate the session identifier upon
successful authentication, invalidating or replacing the pre-authentication
identifier and issuing a fresh session cookie with the new identifier.
h3. Change
* In {{InMemorySessionStore}}:
- Remove session identifier logging from {{createSession()}} (or reduce to
debug with masked/sanitized details).
- Provide a session rotation mechanism (e.g., {{rotateSession(...)}} or
regenerating the session entry) so that an active session can be re-keyed to a
new identifier and a new cookie can be emitted.
* In {{OAuthCodeFlowCallback}}:
- Upon receiving the authenticated {{UserProfile}}, rotate the session
identifier before redirecting to the post-login URL.
* In {{OAuthSessionStore}} interface:
- Add default rotation/invalidation support if needed for session lifecycle
handling.
h3. Tests
* Unit test in {{camel-oauth}} verifying that
{{InMemorySessionStore.createSession()}} does not output the raw session
identifier to standard logger output.
* Unit test verifying that completing the OAuth callback flow rotates the
session identifier and invalidates the previous session identifier.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
