This is an automated email from the ASF dual-hosted git repository.
Croway pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new b7064881cc29 CAMEL-25984: camel-cometd - CORS filter allows
credentials only for listed origins (#28283)
b7064881cc29 is described below
commit b7064881cc29a9a153491616806ed7651bbd45ae
Author: Federico Mariani <[email protected]>
AuthorDate: Fri Oct 23 10:19:09 2026 +0200
CAMEL-25984: camel-cometd - CORS filter allows credentials only for listed
origins (#28283)
* CAMEL-25984: camel-cometd - CORS filter allows credentials only for
listed origins
* CAMEL-25984: camel-cometd - treat a null allowed origin like a wildcard
---
.../camel/component/cometd/CometdComponent.java | 22 +++-
.../cometd/CometdCrossOriginFilterTest.java | 131 +++++++++++++++++++++
.../ROOT/pages/camel-4x-upgrade-guide-4_24.adoc | 8 ++
3 files changed, 160 insertions(+), 1 deletion(-)
diff --git
a/components/camel-cometd/src/main/java/org/apache/camel/component/cometd/CometdComponent.java
b/components/camel-cometd/src/main/java/org/apache/camel/component/cometd/CometdComponent.java
index 3a1d5fdf12af..9c39f3d13af2 100644
---
a/components/camel-cometd/src/main/java/org/apache/camel/component/cometd/CometdComponent.java
+++
b/components/camel-cometd/src/main/java/org/apache/camel/component/cometd/CometdComponent.java
@@ -33,6 +33,7 @@ import org.apache.camel.spi.Metadata;
import org.apache.camel.spi.annotations.Component;
import org.apache.camel.support.DefaultComponent;
import org.apache.camel.support.jsse.SSLContextParameters;
+import org.apache.camel.util.ObjectHelper;
import org.cometd.bayeux.server.BayeuxServer;
import org.cometd.bayeux.server.SecurityPolicy;
import org.cometd.server.BayeuxServerImpl;
@@ -46,6 +47,7 @@ import org.eclipse.jetty.server.Connector;
import org.eclipse.jetty.server.Server;
import org.eclipse.jetty.server.ServerConnector;
import org.eclipse.jetty.server.handler.ContextHandlerCollection;
+import org.eclipse.jetty.util.StringUtil;
import org.eclipse.jetty.util.resource.MountedPathResourceFactory;
import org.eclipse.jetty.util.ssl.SslContextFactory;
import org.slf4j.Logger;
@@ -379,9 +381,27 @@ public class CometdComponent extends DefaultComponent
implements SSLContextParam
FilterHolder filterHolder = new FilterHolder();
CrossOriginFilter filter = new CrossOriginFilter();
filterHolder.setFilter(filter);
- filterHolder.setInitParameter("allowedOrigins",
endpoint.getAllowedOrigins());
+ String allowedOrigins = endpoint.getAllowedOrigins();
+
filterHolder.setInitParameter(CrossOriginFilter.ALLOWED_ORIGINS_PARAM,
allowedOrigins);
+ // Jetty's filter allows credentials unless told otherwise: only
allow them for origins that were named
+
filterHolder.setInitParameter(CrossOriginFilter.ALLOW_CREDENTIALS_PARAM,
+ Boolean.toString(isNamedOrigins(allowedOrigins)));
context.addFilter(filterHolder, endpoint.getFilterPath(),
EnumSet.allOf(DispatcherType.class));
}
}
+ private static boolean isNamedOrigins(String allowedOrigins) {
+ if (ObjectHelper.isEmpty(allowedOrigins)) {
+ return false;
+ }
+ // parse the same way as the filter, and treat any wildcard (such as
https://*) or null (the origin sent by
+ // sandboxed pages) as not naming the origin
+ for (String origin : StringUtil.csvSplit(allowedOrigins)) {
+ if (origin.contains("*") || "null".equalsIgnoreCase(origin)) {
+ return false;
+ }
+ }
+ return true;
+ }
+
}
diff --git
a/components/camel-cometd/src/test/java/org/apache/camel/component/cometd/CometdCrossOriginFilterTest.java
b/components/camel-cometd/src/test/java/org/apache/camel/component/cometd/CometdCrossOriginFilterTest.java
new file mode 100644
index 000000000000..91b47f0d39b5
--- /dev/null
+++
b/components/camel-cometd/src/test/java/org/apache/camel/component/cometd/CometdCrossOriginFilterTest.java
@@ -0,0 +1,131 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.cometd;
+
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+
+import org.apache.camel.builder.RouteBuilder;
+import org.apache.camel.test.AvailablePortFinder;
+import org.apache.camel.test.junit6.CamelTestSupport;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+
+public class CometdCrossOriginFilterTest extends CamelTestSupport {
+
+ private static final String ORIGIN = "https://app.example";;
+
+ @RegisterExtension
+ AvailablePortFinder.Port defaultOriginsPort = AvailablePortFinder.find();
+ @RegisterExtension
+ AvailablePortFinder.Port anyOriginPort = AvailablePortFinder.find();
+ @RegisterExtension
+ AvailablePortFinder.Port wildcardPatternPort = AvailablePortFinder.find();
+ @RegisterExtension
+ AvailablePortFinder.Port namedOriginPort = AvailablePortFinder.find();
+ @RegisterExtension
+ AvailablePortFinder.Port nullOriginPort = AvailablePortFinder.find();
+ @RegisterExtension
+ AvailablePortFinder.Port namedAndNullOriginPort =
AvailablePortFinder.find();
+
+ @Test
+ void testDefaultOriginsDoNotAllowCredentials() throws Exception {
+ assertNoCredentials(defaultOriginsPort.getPort());
+ }
+
+ @Test
+ void testAnyOriginDoesNotAllowCredentials() throws Exception {
+ assertNoCredentials(anyOriginPort.getPort());
+ }
+
+ @Test
+ void testWildcardPatternDoesNotAllowCredentials() throws Exception {
+ assertNoCredentials(wildcardPatternPort.getPort());
+ }
+
+ @Test
+ void testNullOriginDoesNotAllowCredentials() throws Exception {
+ assertNoCredentials(nullOriginPort.getPort(), "null");
+ }
+
+ @Test
+ void testNamedAndNullOriginDoNotAllowCredentials() throws Exception {
+ assertNoCredentials(namedAndNullOriginPort.getPort(), "null");
+ assertNoCredentials(namedAndNullOriginPort.getPort(), ORIGIN);
+ }
+
+ @Test
+ void testNamedOriginAllowsCredentials() throws Exception {
+ HttpResponse<String> response = post(namedOriginPort.getPort(),
ORIGIN);
+ assertEquals(ORIGIN,
response.headers().firstValue("Access-Control-Allow-Origin").orElse(null));
+ assertEquals("true",
response.headers().firstValue("Access-Control-Allow-Credentials").orElse(null));
+ }
+
+ private void assertNoCredentials(int port) throws Exception {
+ assertNoCredentials(port, ORIGIN);
+ }
+
+ private void assertNoCredentials(int port, String origin) throws Exception
{
+ HttpResponse<String> response = post(port, origin);
+ // the origin is still allowed, but without credentials
+ assertEquals(origin,
response.headers().firstValue("Access-Control-Allow-Origin").orElse(null));
+
assertFalse(response.headers().firstValue("Access-Control-Allow-Credentials").isPresent());
+ }
+
+ private HttpResponse<String> post(int port, String origin) throws
Exception {
+ HttpRequest request =
HttpRequest.newBuilder(URI.create("http://127.0.0.1:"; + port + "/cometd"))
+ .POST(HttpRequest.BodyPublishers.ofString(
+
"[{\"channel\":\"/meta/handshake\",\"version\":\"1.0\",\"supportedConnectionTypes\":[\"long-polling\"]}]"))
+ .header("Content-Type", "application/json")
+ .header("Origin", origin)
+ .build();
+ try (HttpClient client = HttpClient.newHttpClient()) {
+ return client.send(request, HttpResponse.BodyHandlers.ofString());
+ }
+ }
+
+ @Override
+ protected RouteBuilder createRouteBuilder() {
+ return new RouteBuilder() {
+ @Override
+ public void configure() {
+ String options =
"?crossOriginFilterOn=true&filterPath=/cometd/*";
+ from("cometd://127.0.0.1:" + defaultOriginsPort.getPort() +
"/service/test" + options)
+ .to("mock:default");
+ from("cometd://127.0.0.1:" + anyOriginPort.getPort() +
"/service/test" + options + "&allowedOrigins=*")
+ .to("mock:any");
+ from("cometd://127.0.0.1:" + wildcardPatternPort.getPort() +
"/service/test" + options
+ + "&allowedOrigins=https://*";)
+ .to("mock:pattern");
+ from("cometd://127.0.0.1:" + namedOriginPort.getPort() +
"/service/test" + options
+ + "&allowedOrigins=" + ORIGIN)
+ .to("mock:named");
+ from("cometd://127.0.0.1:" + nullOriginPort.getPort() +
"/service/test" + options
+ + "&allowedOrigins=null")
+ .to("mock:null");
+ from("cometd://127.0.0.1:" + namedAndNullOriginPort.getPort()
+ "/service/test" + options
+ + "&allowedOrigins=" + ORIGIN + ",null")
+ .to("mock:namedAndNull");
+ }
+ };
+ }
+}
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
index 0ecb5e9d4a4e..1353d4aa9c05 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_24.adoc
@@ -2539,3 +2539,11 @@ a keep-alive message that does not wait for a reply, so
it does not find such a
noop is a request that waits for the reply, so with `sendNoop=false` such a
connection is found by the next poll,
which fails and is logged before the consumer connects again. For sftp and
mina-sftp, set `serverAliveInterval` to let
the client close such a connection itself, so that the consumer connects again
before the poll.
+
+=== camel-cometd - the CORS filter allows credentials only for listed origins
+
+With `crossOriginFilterOn=true`, the CORS responses now include
`Access-Control-Allow-Credentials: true` only when
+`allowedOrigins` lists the origins explicitly, without any `*` or `null`. When
`allowedOrigins` is not set, is `*`, or
+has an entry with a wildcard such as `https://*` or an entry `null`, the
origin is still allowed, but without credentials. Previously credentials
+were allowed for every origin. A cross-origin client that sends cookies or
other credentials must have its origin
+listed in `allowedOrigins`.
