[jira] [Created] (CAMEL-24452) camel-http - credentials are sent to redirect targets on a different host

["Andrea Cosentino (Jira)" <ji...@apache.org>]

Andrea Cosentino created CAMEL-24452:
----------------------------------------

             Summary: camel-http - credentials are sent to redirect targets on a different host
                 Key: CAMEL-24452
                 URL: https://issues.apache.org/jira/browse/CAMEL-24452
             Project: Camel
          Issue Type: Bug
          Components: camel-http
            Reporter: Andrea Cosentino
            Assignee: Andrea Cosentino
             Fix For: 4.23.0


Two independent paths send credentials to a host the endpoint was never configured with, once {{followRedirects=true}}:

1. {{OAuth2ClientConfigurer.configureHttpClient}} registers a request interceptor with {{addRequestInterceptorFirst}} that sets {{Authorization: Bearer <token>}} unconditionally. HttpClient 5 runs protocol-level request interceptors inside {{ProtocolExec}}, which sits below {{RedirectExec}} in the exec chain, so the interceptor runs again for each redirect hop and re-attaches the token to whatever host the {{Location}} header named. Nothing compares the request target with the endpoint's configured host, and HC5's cross-site auth-state reset does not apply because the header is set directly rather than through the auth exchange.

2. {{HttpCredentialsHelper.getCredentialsProvider}} calls {{setCredentials(new AuthScope(host, port), credentials)}} with the endpoint's {{authHost}}, which is optional and null in the common basic-auth setup - {{new AuthScope(null, -1)}} matches any host, any port, any scheme. HttpClient then offers those credentials to whichever host issues a 401 Basic challenge.

Proposal: for the OAuth2 interceptor, compare the request's host against the endpoint's configured host and skip the header when they differ (or move the token onto the exec chain above {{RedirectExec}}). For basic auth, default the {{AuthScope}} host to the endpoint's host when {{authHost}} is not set.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)