[
https://issues.apache.org/jira/browse/CAMEL-26831?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen resolved CAMEL-26831.
---------------------------------
Resolution: Fixed
Fixed by https://github.com/apache/camel/pull/29638 (merged as ac50a34b96c5 on
main, 4.24.0).
_Claude Code on behalf of davsclaus_
> camel-spiffe - preserve request bodies during JWT-SVID validation
> -----------------------------------------------------------------
>
> Key: CAMEL-26831
> URL: https://issues.apache.org/jira/browse/CAMEL-26831
> Project: Camel
> Issue Type: Improvement
> Components: camel-spiffe
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Labels: authorization, camel-spiffe, component-audit
> Fix For: 4.24.0
>
>
> h2. Problem / motivation
> validateJwtSvid replaces the body with JwtSvid even when the token was read
> from Authorization. A protected POST/PUT route therefore needs extra steps to
> save and restore its application payload. This is documented existing
> behavior, not an unexpected regression.
> h2. Proposed scope
> Add an opt-in body-preserving validation result mode and a typed verified
> identity/claims exchange property. Provide a JWT-backed security-policy
> wrapper for route segments, preserving configured audience enforcement and
> existing default response behavior.
> h2. Acceptance criteria / validation
> * Validate header-token requests carrying POJO and streaming bodies without
> consuming/replacing them in the new mode.
> * Cover valid, expired, invalid, absent and wrong-audience tokens and
> existing multiple-audience behavior.
> * Add Java/XML/YAML usage and catalog metadata; keep token material out of
> diagnostics.
> h2. References
> *
> https://github.com/apache/camel/blob/5686684cb418/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeProducer.java#L76
> *
> https://github.com/apache/camel/blob/5686684cb418/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeSecurityPolicy.java
> Source: read-only component audit at 5686684cb418. Recheck current main
> before implementing; historical references identify the audited code.
> _AI-generated by Codex on behalf of oscerd (JIRA: acosentino)._
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
