Croway opened a new pull request, #28283: URL: https://github.com/apache/camel/pull/28283
[CAMEL-25984](https://issues.apache.org/jira/browse/CAMEL-25984) With `crossOriginFilterOn=true`, camel-cometd installs Jetty's `CrossOriginFilter` with only `allowedOrigins` set, so `allowCredentials` stays at the Jetty default (`true`) for every origin, including the `*` default. `allowCredentials` is now always set on the filter: `true` only when `allowedOrigins` lists the origins explicitly (no entry containing `*`, split as the filter does), `false` otherwise. Cross-origin requests without credentials keep working. - `CometdComponent.applyCrossOriginFiltering`: set `allowCredentials`. - Upgrade guide 4.24: note on the new behaviour. ## Tests - `CometdCrossOriginFilterTest`: with `allowedOrigins` unset, `*` or `https://*` the origin is allowed without `Access-Control-Allow-Credentials`; a listed origin keeps `Access-Control-Allow-Credentials: true`. The three no-credentials tests fail without the change. - All 30 tests of camel-cometd pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
