This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 952be290b1ab CAMEL-25568: Upgrade guide - camel-oauth notes for 4.22.2
and 4.18.6 (#27864)
952be290b1ab is described below
commit 952be290b1abca131504777301dcc4c3360689fa
Author: Andrea Cosentino <[email protected]>
AuthorDate: Thu Oct 15 09:52:49 2026 +0200
CAMEL-25568: Upgrade guide - camel-oauth notes for 4.22.2 and 4.18.6
(#27864)
Add the camel-oauth note of the 4.24 upgrade guide to the 4.22.1 to
4.22.2 and the 4.18.5 to 4.18.6 sections, for the backports of the
stateless OAuthBearerTokenProcessor. On 4.18.x the token validation API
of camel-support does not exist, so that note points to the OAuth
instance of camel-oauth instead.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: Andrea Cosentino <[email protected]>
---
.../ROOT/pages/camel-4x-upgrade-guide-4_18.adoc | 21 +++++++++++++++++++++
.../ROOT/pages/camel-4x-upgrade-guide-4_22.adoc | 20 ++++++++++++++++++++
2 files changed, 41 insertions(+)
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
index 81866e1a0496..62c767765737 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
@@ -69,6 +69,27 @@ registered.
To restore the previous behaviour, set `webhookSecretTokenEnabled=false`: the
webhook is then registered without a
secret token, and webhook requests are not verified.
+=== camel-oauth - the bearer token processor is stateless and reads the HTTP
request headers
+
+`OAuthBearerTokenProcessor` no longer creates or updates the OAuth session,
and no longer sets the
+`camel.oauth.session` cookie nor the `CamelOAuthSessionId` header: a bearer
token authenticates the request that
+carries it, and nothing else. The authenticated `UserProfile` is available in
the `CamelOAuthUserProfile` exchange
+property (`OAuth.CAMEL_OAUTH_USER_PROFILE`). A route that read the profile
from the OAuth session after
+`OAuthBearerTokenProcessor` must read it from that exchange property instead.
+
+When the message comes from platform-http (on Vert.x or on Spring Boot), from
a servlet based HTTP consumer
+(camel-servlet, camel-jetty) or from camel-netty-http, the bearer token and
the session cookie are now read from the
+`Authorization` and `Cookie` headers of the HTTP request only. A query or form
parameter of the same name, which these
+consumers also map into the message headers, is no longer used for them, and
neither is an `Authorization` or `Cookie`
+message header that the route sets itself. For example
+`+.setHeader("Authorization", simple("Bearer
${header.X-Forwarded-Access-Token}"))+` before
+`OAuthBearerTokenProcessor` now results in a 401 response. A route that takes
the token from elsewhere can
+authenticate it itself, with `authenticate(new TokenCredentials(token))` on
the `OAuth` instance that
+`OAuthFactory.lookupFactory(context).findOAuth()` returns.
+
+For any other message, such as one from camel-undertow, the processors keep
reading the message headers, but leave out
+a value that also appears in the query string of the request.
+
=== camel-spring-ws - internal Camel headers are no longer written into SOAP
headers
The default `messageFilter` of the `spring-ws` component,
`BasicMessageFilter`, now applies the endpoint's
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
index 73fc892e03fb..491b784aa7a3 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
@@ -179,6 +179,26 @@ than the configured `maxDecompressedSize` fails with an
`IOException`, as docume
`IOHelper.copy(InputStream, OutputStream, int, boolean, long)` now returns
`Integer.MAX_VALUE`, instead of a
negative number, when it copies more than `Integer.MAX_VALUE` bytes.
+=== camel-oauth - the bearer token processor is stateless and reads the HTTP
request headers
+
+`OAuthBearerTokenProcessor` no longer creates or updates the OAuth session,
and no longer sets the
+`camel.oauth.session` cookie nor the `CamelOAuthSessionId` header: a bearer
token authenticates the request that
+carries it, and nothing else. The authenticated `UserProfile` is available in
the `CamelOAuthUserProfile` exchange
+property (`OAuth.CAMEL_OAUTH_USER_PROFILE`). A route that read the profile
from the OAuth session after
+`OAuthBearerTokenProcessor` must read it from that exchange property instead.
+
+When the message comes from platform-http (on Vert.x or on Spring Boot), from
a servlet based HTTP consumer
+(camel-servlet, camel-jetty) or from camel-netty-http, the bearer token and
the session cookie are now read from the
+`Authorization` and `Cookie` headers of the HTTP request only. A query or form
parameter of the same name, which these
+consumers also map into the message headers, is no longer used for them, and
neither is an `Authorization` or `Cookie`
+message header that the route sets itself. For example
+`+.setHeader("Authorization", simple("Bearer
${header.X-Forwarded-Access-Token}"))+` before
+`OAuthBearerTokenProcessor` now results in a 401 response. A route that takes
the token from elsewhere can validate it
+with `OAuthHelper.validateOAuthToken` from camel-support instead.
+
+For any other message, such as one from camel-undertow, the processors keep
reading the message headers, but leave out
+a value that also appears in the query string of the request.
+
=== camel-oauth - the post login url is confined to the configured redirect
uri origin
The post login url of the authorization code flow is now always built from the
origin (`scheme://host[:port]`)
