oscerd opened a new pull request, #25578: URL: https://github.com/apache/camel/pull/25578
Fixes [CAMEL-24412](https://issues.apache.org/jira/browse/CAMEL-24412). ## Problem `HttpServerChannelHandler.extractTarget()` strips the endpoint context-path so the security constraint is evaluated relative to the endpoint. The strip was guarded by a **case-sensitive** `startsWith`: ```java if (path != null && target.startsWith(path)) { // need to match by lower case as we want to ignore case on context-path path = path.toLowerCase(Locale.US); String match = target.toLowerCase(Locale.US); if (match.startsWith(path)) { target = target.substring(path.length()); } } ``` The inner case-insensitive comparison can never change the outcome — it is **dead code**. A request whose context-path differs only by case is evaluated against the *unstripped* target. Dispatch does not share that property: `RestConsumerContextPathMatcher.matchPath()` compares with `equalsIgnoreCase` and a lower-cased prefix, so the request still reaches the route. Authorization and dispatch disagreed about which endpoint a request belongs to. With `matchOnUriPrefix=true` and a `securityConstraint` whose inclusions are **specific sub-paths rather than a catch-all**, the miscased target matches no inclusion — and in `SecurityConstraintMapping`, an unmatched target counts as *unrestricted*. ## Change The strip uses the case-insensitive comparison directly, so the constraint sees the same normalized target the request is routed to. ## Tests `NettyHttpBasicAuthConstraintCaseInsensitiveTest` covers both directions against a constraint with a specific `/admin/*` inclusion: | Request | Before | After | |---|---|---| | `GET /foo/admin/x` (no credentials) | 401 | 401 | | `GET /Foo/admin/x` (no credentials) | **200 — route reached, constraint skipped** | 401 | Verified by reverting the fix: `differentlyCasedContextPathIsChallengedToo` fails with *"Expected CamelExecutionException to be thrown, but nothing was thrown"*. ``` mvn test -Dtest=NettyHttpBasicAuthConstraintCaseInsensitiveTest # 2 passed mvn clean install -DskipTests # full reactor, BUILD SUCCESS ``` Note the existing `NettyHttpBasicAuthConstraintMapperTest` uses a catch-all `/*` inclusion, which is why it never surfaced this — with a catch-all the miscased path still matches and is challenged. ## Backport Intended for **camel-4.22.x, camel-4.18.x and camel-4.14.x**: it restores the intended behaviour of an existing control, adds no option and changes no API. Deployments relying on reaching a route without a challenge via a miscased path will now receive 401 — covered by the upgrade-guide entry on `main`. --- _Claude Code on behalf of -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
