[jira] [Updated] (CAMEL-24450) camel-jetty - enableCORS installs Jetty's CrossOriginFilter with its allow-all defaults

["Andrea Cosentino (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-24450?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Andrea Cosentino updated CAMEL-24450:
-------------------------------------
    Fix Version/s: 4.22.1
                   4.18.5

> camel-jetty - enableCORS installs Jetty's CrossOriginFilter with its allow-all defaults
> ---------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24450
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24450
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-jetty
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Major
>             Fix For: 4.22.1, 4.23.0, 4.18.5
>
>
> {{JettyHttpComponent.doCreateEndpoint()}} adds {{new CrossOriginFilter()}} with no init parameters when {{enableCORS=true}}. Jetty's filter defaults to {{allowedOrigins="*"}} with {{allowCredentials=true}}, so the origin is reflected and credentials are permitted.
> Init parameters can only be supplied through the generic {{filterInit.*}} options, which the {{enableCORS}} documentation does not point users towards.
> An option named "enable CORS" should not silently mean "every origin, with credentials". Compare the same shape in {{VertxPlatformHttpServerSupport.createCorsHandler()}}.
> Proposal: pass explicit init parameters derived from Camel-level options (allowed origins, methods, headers, credentials), defaulting to something that requires the operator to name the origins, and document the mapping. Needs an upgrade-guide entry.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)