Andrea Cosentino created CAMEL-25568:
----------------------------------------
Summary: camel-oauth - make OAuthBearerTokenProcessor stateless
and read credentials from HTTP request headers
Key: CAMEL-25568
URL: https://issues.apache.org/jira/browse/CAMEL-25568
Project: Camel
Issue Type: Improvement
Components: camel-oauth
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.24.0, 4.18.6, 4.22.2
{{OAuthBearerTokenProcessor}} and {{InMemorySessionStore}} read request
credentials from the Camel message header map:
* {{OAuthBearerTokenProcessor}} reads the bearer token with
{{msg.getHeader("Authorization")}}.
* {{InMemorySessionStore.getSession()}} reads the session id from the
{{Cookie}} message header.
HTTP consumers such as platform-http and servlet also map query and form
parameters into that header map, so these values are not guaranteed to come
from the corresponding HTTP request headers. RFC 6750 section 2.1 defines the
{{Authorization}} request header as the bearer token transport.
In addition, {{OAuthBearerTokenProcessor}} calls {{OAuth.getOrCreateSession()}}
and {{OAuthSession.putUserProfile()}} after authenticating a token, so a
per-request bearer authentication creates or updates a camel-oauth session and
may emit a {{camel.oauth.session}} cookie.
Proposal:
* Read {{Authorization}} and {{Cookie}} from the underlying HTTP request
headers when the message carries the HTTP request (platform-http on Vert.x,
servlet), as the {{oauthProfile}} integrations in camel-servlet, camel-jetty,
camel-netty-http and camel-undertow already do for {{Authorization}}.
* Make {{OAuthBearerTokenProcessor}} stateless: do not create or update an
{{OAuthSession}} and do not set a cookie; expose the authenticated
{{UserProfile}} on the exchange instead.
Routes that read the user profile from the OAuth session after
{{OAuthBearerTokenProcessor}} need to read it from the exchange instead, so
this needs an upgrade-guide entry.
_Claude Code on behalf of oscerd_
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
