[
https://issues.apache.org/jira/browse/CAMEL-25993?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen closed CAMEL-25993.
-------------------------------
Resolution: Duplicate
Both parts of this ticket are already on main:
* JSONP off by default: CAMEL-26335 added the {{allowedTransports}} endpoint
option, which defaults to {{websocket,long-polling}}, so {{callback-polling}}
(JSONP) is opt-in.
* {{Origin: null}}: CAMEL-25984 treats {{null}} in {{allowedOrigins}} like a
wildcard, so it is allowed without credentials.
Closing as a duplicate of those two.
_Claude Code on behalf of davsclaus_
> camel-cometd - turn on the JSONP transport only when asked for, and do not
> allow credentials for the null origin
> ----------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-25993
> URL: https://issues.apache.org/jira/browse/CAMEL-25993
> Project: Camel
> Issue Type: Improvement
> Components: camel-cometd
> Reporter: Claus Ibsen
> Priority: Minor
> Fix For: 4.24.0
>
>
> The CometD server that camel-cometd creates
> (CometdComponent.createServletForConnector) sets no {{transports}} or
> {{allowedTransports}} init parameter, so CometD turns on every HTTP transport
> it has: {{long-polling}} and {{callback-polling}} (JSONP). Checked on
> 4.24.0-SNAPSHOT with CometD 9.0.1:
> {{BayeuxServerImpl.getAllowedTransports()}} returns {{[long-polling,
> callback-polling]}}.
> JSONP is a legacy transport for browsers without CORS support. The
> cross-origin options of the endpoint ({{crossOriginFilterOn}},
> {{allowedOrigins}}) only apply to XHR/fetch requests, so they have no effect
> on clients that use JSONP. Few users need JSONP today, so it should be
> something a user turns on.
> A related detail from CAMEL-25984: with {{allowedOrigins=null}}, the filter
> answers {{Origin: null}} with {{Access-Control-Allow-Credentials: true}}. Any
> sandboxed iframe sends {{Origin: null}}, so {{null}} should be treated like a
> wildcard: allowed, but without credentials.
> *Proposed change*
> * Configure the CometD servlet with {{allowedTransports=long-polling}} by
> default, and add an endpoint option to turn JSONP ({{callback-polling}}) back
> on.
> * Treat {{null}} in {{allowedOrigins}} like a wildcard when deciding
> {{allowCredentials}}.
> * Upgrade guide note for 4.24: clients that use the JSONP transport need the
> new option.
> * Tests for both.
> Main only, as it changes a default.
> _Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
