davsclaus opened a new pull request, #25870: URL: https://github.com/apache/camel/pull/25870
## Backport of #25641 Cherry-pick of #25641 onto `camel-4.18.x`. **Original PR:** #25641 - CAMEL-24429: camel-as2 - confine per-request signing keys to the request in ResponseMDN **Original author:** @oscerd **Target branch:** `camel-4.18.x` ### Original description ResponseMDN held the AS2 security material in mutable instance fields and overwrote them per request when the keys are dynamic. A single ResponseMDN is registered on the shared HttpProcessor and serves every request; the assignment block was not covered by the class's lock, and the values stayed in place after the request that set them. A deployment hosting several partners on different paths, each with its own keys, could therefore sign one partner's MDN with another partner's private key, or validate against the wrong chain. process() now resolves the five values into locals for the duration of the call; the fields and keysAreDynamic are now final as a regression guard. See original PR for full details. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
