davsclaus opened a new pull request, #29749: URL: https://github.com/apache/camel/pull/29749
Fixes https://issues.apache.org/jira/browse/CAMEL-25981 With `camel.knative.service.oidc.enabled=true`, the Knative Http consumer accepts a request only when its `Authorization` header is `Bearer ` followed by the token mounted at `camel.knative.service.oidc.token.path`. This PR improves that check: - **Constant-time comparison:** the header is compared with `MessageDigest.isEqual` instead of `String.equals` (new `KnativeOidcServiceOptions.isAuthorized`). - **Token renewal:** the token is cached by default (`cache.tokens=true`), so after Knative renewed the mounted token, requests with the new token got 401 until a restart, while the old token was still accepted. Now, when the header does not match the cached token, the token file is read again before the request is refused. The renewed token is accepted, and once the cache holds it, the replaced token is refused. This mirrors `renew.tokens.on.forbidden` on the client side. - **No null token under concurrency:** `renewOidcToken()` used to set the field to null and then read it again, so a concurrent `retrieveOidcToken()` could return null. Both methods now work on a local value and assign it, and the field is volatile. - **Docs:** a new "Knative Http consumer factory" section documents the service options (`enabled`, `token.path`, `cache.tokens`), how to configure them with `#class:`, the renewal behaviour, and that the consumer compares the token with the mounted one: it does not validate it as an OIDC token (signature, issuer, audience, expiry). Validating it as a JWT could be a follow-up. ## Tests New `KnativeHttpOidcConsumerTest` (token in a temp file, requests with RestAssured): - the mounted token is accepted; another token, a prefix, a longer value, a missing `Bearer` and a missing header get 401 and do not reach the route; - after the file is rewritten, the renewed token is accepted and the old token is refused (with and without the cache); - configuration through properties and `consumerFactory.serviceOptions=#class:...`. The two renewal tests fail on main. `KnativeHttpTest` (186 tests) still passes. _Claude Code on behalf of davsclaus_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
