[
https://issues.apache.org/jira/browse/CAMEL-25162?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen updated CAMEL-25162:
--------------------------------
Fix Version/s: 4.23.0
> camel-oauth - confine the reconstructed post-login URL to the configured
> redirect URI origin
> --------------------------------------------------------------------------------------------
>
> Key: CAMEL-25162
> URL: https://issues.apache.org/jira/browse/CAMEL-25162
> Project: Camel
> Issue Type: Improvement
> Components: camel-oauth
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> {{OAuthCodeFlowProcessor.getPostLoginUrl()}} rebuilds the absolute post-login
> URL from the inbound {{X-Forwarded-Proto}} / {{X-Forwarded-Host}} /
> {{X-Forwarded-Port}} request headers and stores it in the OAuth session.
> {{OAuthCodeFlowCallback}} later emits that value as the {{Location}} header
> of the post-login redirect.
> The reconstruction was added in CAMEL-21899 so that deployments behind an
> OpenShift Route/Ingress redirect to the externally reachable URL rather than
> the internally observed one. That behaviour must be preserved.
> The assembled origin is never compared against the deployment's own origin,
> so the forwarded header values are used as-is. The component should confine
> the result:
> * derive the expected origin from the configured {{CAMEL_OAUTH_REDIRECT_URI}}
> * accept the {{X-Forwarded-*}} reconstruction only when the resulting origin
> matches it
> * fall back to the configured origin otherwise
> Two smaller issues in the same method:
> * {{X-Forwarded-Host}} may be a comma-separated list when several proxies are
> chained ({{host1, host2}}); the current code concatenates the whole list into
> the URL and produces a malformed value.
> * The {{else}} branch returns {{Exchange.HTTP_URL}} unchanged, with no
> confinement either.
> h3. Affected code
> *
> {{components/camel-oauth/src/main/java/org/apache/camel/oauth/OAuthCodeFlowProcessor.java}}
> ({{getPostLoginUrl}})
> h3. Acceptance
> Unit tests covering a matching origin, a non-matching origin, a
> comma-separated {{X-Forwarded-Host}}, and absent forwarded headers.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
