[
https://issues.apache.org/jira/browse/CAMEL-26335?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-26335 started by Andrea Cosentino.
------------------------------------------------
> camel-cometd - configure allowedTransports and disable callback-polling by
> default
> ----------------------------------------------------------------------------------
>
> Key: CAMEL-26335
> URL: https://issues.apache.org/jira/browse/CAMEL-26335
> Project: Camel
> Issue Type: Bug
> Components: camel-cometd
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.18.6, 4.22.3, 4.24.0
>
>
> h3. Current behaviour
> The CometD server that camel-cometd creates
> (CometdComponent.createServletForConnector) does not configure the
> {{allowedTransports}} servlet init parameter. CometD defaults to enabling all
> bundled HTTP transports: {{websocket}}, {{long-polling}}, and
> {{callback-polling}} (JSONP).
> JSONP is a legacy transport. The cross-origin options of the endpoint
> ({{crossOriginFilterOn}}, {{allowedOrigins}}) only apply to CORS requests
> (XHR/fetch), having no effect on JSONP requests initiated via script tags.
> Currently, camel-cometd provides no endpoint or component option to restrict
> the allowed transports or disable callback-polling.
> h3. Expected behaviour
> camel-cometd should configure {{allowedTransports}} on CometDServlet to
> {{websocket,long-polling}} by default so that callback-polling (JSONP) is
> disabled out of the box. Users who require JSONP can explicitly enable it via
> a new endpoint option ({{allowedTransports}}).
> h3. Change
> * In {{CometdComponent.createServletForConnector}}, set the
> {{allowedTransports}} init parameter on CometDServlet to
> {{endpoint.getAllowedTransports()}}, which defaults to
> {{"websocket,long-polling"}}.
> * In {{CometdEndpoint}}, add the {{allowedTransports}} option with default
> value {{"websocket,long-polling"}}.
> * Upgrade guide notes for 4.24 and maintenance branches: clients using JSONP
> must explicitly set {{allowedTransports}} to include {{callback-polling}}.
> h3. Tests
> * Verify that by default a JSONP request ({{callback-polling}}) is rejected
> by the CometD servlet.
> * Verify that when {{allowedTransports}} is configured to include
> {{callback-polling}}, JSONP requests succeed.
> * Verify standard {{long-polling}} continues to operate normally.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
