[
https://issues.apache.org/jira/browse/CAMEL-25162?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18121611#comment-18121611
]
Claus Ibsen commented on CAMEL-25162:
-------------------------------------
Backported to camel-4.18.x via https://github.com/apache/camel/pull/27180 and
camel-4.22.x via https://github.com/apache/camel/pull/27179
> camel-oauth - confine the reconstructed post-login URL to the configured
> redirect URI origin
> --------------------------------------------------------------------------------------------
>
> Key: CAMEL-25162
> URL: https://issues.apache.org/jira/browse/CAMEL-25162
> Project: Camel
> Issue Type: Improvement
> Components: camel-oauth
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.18.5, 4.22.2, 4.23.0
>
>
> {{OAuthCodeFlowProcessor.getPostLoginUrl()}} rebuilds the absolute post-login
> URL from the inbound {{X-Forwarded-Proto}} / {{X-Forwarded-Host}} /
> {{X-Forwarded-Port}} request headers and stores it in the OAuth session.
> {{OAuthCodeFlowCallback}} later emits that value as the {{Location}} header
> of the post-login redirect.
> The reconstruction was added in CAMEL-21899 so that deployments behind an
> OpenShift Route/Ingress redirect to the externally reachable URL rather than
> the internally observed one. That behaviour must be preserved.
> The assembled origin is never compared against the deployment's own origin,
> so the forwarded header values are used as-is. The component should confine
> the result:
> * derive the expected origin from the configured {{CAMEL_OAUTH_REDIRECT_URI}}
> * accept the {{X-Forwarded-*}} reconstruction only when the resulting origin
> matches it
> * fall back to the configured origin otherwise
> Two smaller issues in the same method:
> * {{X-Forwarded-Host}} may be a comma-separated list when several proxies are
> chained ({{host1, host2}}); the current code concatenates the whole list into
> the URL and produces a malformed value.
> * The {{else}} branch returns {{Exchange.HTTP_URL}} unchanged, with no
> confinement either.
> h3. Affected code
> *
> {{components/camel-oauth/src/main/java/org/apache/camel/oauth/OAuthCodeFlowProcessor.java}}
> ({{getPostLoginUrl}})
> h3. Acceptance
> Unit tests covering a matching origin, a non-matching origin, a
> comma-separated {{X-Forwarded-Host}}, and absent forwarded headers.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
