davsclaus opened a new pull request, #29260: URL: https://github.com/apache/camel/pull/29260
_Claude Code on behalf of Claus Ibsen_ ## Problem [CAMEL-26281](https://issues.apache.org/jira/browse/CAMEL-26281) In webhook mode (`webhook:whatsapp:...`), the `X-Hub-Signature-256` signature that WhatsApp puts on every event was checked only when `webhookSecret` was set. The option had no default, and the examples on the component page did not set it, so a webhook route configured as documented processed events without checking their signature. The endpoint also answered an event with the request body. ## Change - New option `webhookVerification` (default `true`, label `security`, marked `insecure:dev` with `insecureValue = "false"`, like `webhookSecretTokenEnabled` of camel-telegram). - With verification on, a `webhook:whatsapp:` route without `webhookSecret` (or with an empty one) fails to start, with a message that names `webhookSecret` and `webhookVerification=false`. This follows the webhook consumer of camel-openai. - Every event is verified with `webhookSecret`. An event with a missing or invalid signature is answered with 403, with no body, and does not reach the route. An empty secret is treated as missing. - With `webhookVerification=false`, events are not verified, and the endpoint logs a WARN when the webhook consumer is created. - An event that reaches the route is answered with an empty body and status 200 (unless the route set a status code or failed). The reply to the verification request (`GET`) is still the `hub.challenge`. - Docs: the Java and YAML webhook examples set `webhookSecret`, and a paragraph explains verification and the opt-out. The body type descriptions of the endpoint are updated. - Upgrade guide 4.24: entry "camel-whatsapp - webhook events are verified by default". - Regenerated the component JSON, configurer, URI factory, catalog and endpoint DSL. ## Tests - `WhatsAppWebhookStartupTest` (new): a webhook route without `webhookSecret`, or with an empty one, fails to start; with a secret, or with `webhookVerification=false`, it starts. - `WhatsAppWebhookProcessorTest`: `eventWithValidSignatureIsRouted`, `eventWithoutSignatureIsRejectedWith403AndNotRouted`, `eventWithSignatureOfAnotherSecretIsRejectedWith403AndNotRouted`, `eventIsRejectedWith403WhenTheSecretIsMissing`, `eventIsRoutedWithoutSignatureWhenVerificationIsDisabled`, `eventReplyHasEmptyBody`, `eventReplyKeepsTheResponseCodeOfTheRoute`; the existing event tests now sign their events. - `WhatsAppWebhookTest`: the route sets `webhookSecret`, the posted event is signed and gets an empty reply, and an unsigned event gets 403 over HTTP. - The new tests fail on the code before this change (the route starts without a secret, an event is routed without a signature, the reply carries the event). `mvn install` in `components/camel-whatsapp`: 32 tests, 0 failures. Full `mvn -Dquickly install` passes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
