[
https://issues.apache.org/jira/browse/CAMEL-26319?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-26319 started by Andrea Cosentino.
------------------------------------------------
> camel-oauth: InMemorySessionStore should not log session identifiers and
> OAuthCodeFlowCallback should rotate session identifiers on login
> -----------------------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-26319
> URL: https://issues.apache.org/jira/browse/CAMEL-26319
> Project: Camel
> Issue Type: Bug
> Components: camel-oauth
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.18.6, 4.22.3, 4.24.0
>
>
> h3. Current behaviour
> In {{org.apache.camel.oauth.InMemorySessionStore.createSession(Exchange)}}
> (camel-oauth), the session identifier is logged at INFO level when creating a
> new session:
> {code:java}
> var sessionId = UUID.randomUUID().toString();
> var session = new InMemorySession(sessionId);
> sessions.put(sessionId, session);
> var msg = exchange.getMessage();
> log.info("New OAuthSession: {}", sessionId);
> setSessionCookie(msg, session);
> {code}
> In addition, during the authorization code flow,
> {{OAuthCodeFlowCallback.process(Exchange)}} retrieves the existing session
> and stores the authenticated {{UserProfile}} directly into it without
> rotating the session identifier:
> {code:java}
> var session = oauth.getOrCreateSession(exchange);
> ...
> var userProfile = oauth.authenticate(...);
> session.putUserProfile(userProfile);
> {code}
> As a result, session identifiers appear in standard application logs, and the
> pre-authentication session identifier continues to identify the authenticated
> session post-login.
> h3. Expected behaviour
> * {{InMemorySessionStore}} should not emit session identifiers at standard
> log levels (INFO/WARN/ERROR).
> * {{OAuthCodeFlowCallback}} should rotate the session identifier upon
> successful authentication, invalidating or replacing the pre-authentication
> identifier and issuing a fresh session cookie with the new identifier.
> h3. Change
> * In {{InMemorySessionStore}}:
> - Remove session identifier logging from {{createSession()}} (or reduce to
> debug with masked/sanitized details).
> - Provide a session rotation mechanism (e.g., {{rotateSession(...)}} or
> regenerating the session entry) so that an active session can be re-keyed to
> a new identifier and a new cookie can be emitted.
> * In {{OAuthCodeFlowCallback}}:
> - Upon receiving the authenticated {{UserProfile}}, rotate the session
> identifier before redirecting to the post-login URL.
> * In {{OAuthSessionStore}} interface:
> - Add default rotation/invalidation support if needed for session lifecycle
> handling.
> h3. Tests
> * Unit test in {{camel-oauth}} verifying that
> {{InMemorySessionStore.createSession()}} does not output the raw session
> identifier to standard logger output.
> * Unit test verifying that completing the OAuth callback flow rotates the
> session identifier and invalidates the previous session identifier.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
