[
https://issues.apache.org/jira/browse/CAMEL-24739?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen updated CAMEL-24739:
--------------------------------
Fix Version/s: 4.23.0
> camel-spiffe - allow fetchX509Svid without placing the private key on the
> message
> ---------------------------------------------------------------------------------
>
> Key: CAMEL-24739
> URL: https://issues.apache.org/jira/browse/CAMEL-24739
> Project: Camel
> Issue Type: Improvement
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.23.0
>
>
> h2. Problem
> {{fetchX509Svid}} sets the whole {{X509Svid}} as the message body:
> {code:java}
> X509Svid svid = client.fetchX509Context().getDefaultSvid();
> message.setBody(svid);
> {code}
> {{X509Svid}} carries the *private key*. A route that only wants to know its
> own identity - to log it, to route on it, to put the SPIFFE ID in a header -
> has no way to avoid handling key material, and any tracing, logging or error
> handler that touches the body then handles it too.
> This was flagged in review (CAMEL-23305) and the documentation warns against
> logging the body for these operations, which is a mitigation for the symptom
> rather than for the exposure.
> h2. Proposal
> Let the route ask for what it actually needs. For example an option or
> operation variant that returns only the SPIFFE ID and expiry (already
> available as {{CamelSpiffeSpiffeId}} / {{CamelSpiffeExpiry}} headers) and
> leaves the body untouched, or returns the certificate chain without the key.
> The full {{X509Svid}} must remain available - it is what makes programmatic
> mTLS possible - so this is about not making the key the *default* payload for
> a route that never asked for it.
> h2. Scope
> {{main}} only. Additive; the current behaviour stays reachable.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
