davsclaus commented on code in PR #29749:
URL: https://github.com/apache/camel/pull/29749#discussion_r4555816947
##########
components/camel-knative/camel-knative-http/src/main/java/org/apache/camel/component/knative/http/KnativeOidcServiceOptions.java:
##########
@@ -81,26 +87,58 @@ public void configureOptions(CamelContext camelContext) {
* Read OIDC token from given path. Caches the token for future usage.
*/
public String retrieveOidcToken() {
- if (oidcToken == null || !cacheTokens) {
- try {
- oidcToken = IOHelper
-
.loadText(ResourceHelper.resolveMandatoryResourceAsInputStream(getCamelContext(),
oidcTokenPath))
- .trim();
- } catch (IOException e) {
- throw new RuntimeException(e);
- }
+ String token = oidcToken;
+ if (token == null || !cacheTokens) {
+ token = loadOidcToken();
+ oidcToken = token;
}
- return oidcToken;
+ return token;
}
/**
* Force renew of token by reading again from token path. Token may have
been renewed already via volume mount
* update.
*/
public String renewOidcToken() {
- oidcToken = null;
- return retrieveOidcToken();
+ String token = loadOidcToken();
+ oidcToken = token;
+ return token;
+ }
+
+ /**
+ * Whether the given value of the <code>Authorization</code> header is
<code>Bearer</code> followed by the token at
+ * the token path. The comparison takes the same time wherever the first
difference is. When the cached token does
Review Comment:
Thanks for checking this, but on the JDKs Camel supports (21+)
`MessageDigest.isEqual` does not return early when the lengths differ. It folds
the length difference into the result (`result |= lenA - lenB`) and always
loops over the length of the **first** argument. `matches` passes the expected
`Bearer <token>` first and the request header second, so the time depends only
on the length of the mounted token, never on the header the client sends, and
timing a header of varying length tells nothing.
So I kept the guarantee, but made it explicit in 5c58b4d1caf8: the Javadoc
now says the time depends only on the length of the token, and a comment on
`matches` says why the expected value has to be the first argument, so a later
edit does not swap them.
_Claude Code on behalf of davsclaus_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
