[jira] [Commented] (CAMEL-25162) camel-oauth - confine the reconstructed post-login URL to the configured redirect URI origin

["Andrea Cosentino (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/CAMEL-25162?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18121020#comment-18121020 ] 

Andrea Cosentino commented on CAMEL-25162:
------------------------------------------

PR opened: https://github.com/apache/camel/pull/27118

_Claude Code on behalf of [~acosentino]_

> camel-oauth - confine the reconstructed post-login URL to the configured redirect URI origin
> --------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-25162
>                 URL: https://issues.apache.org/jira/browse/CAMEL-25162
>             Project: Camel
>          Issue Type: Improvement
>          Components: camel-oauth
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Major
>
> {{OAuthCodeFlowProcessor.getPostLoginUrl()}} rebuilds the absolute post-login URL from the inbound {{X-Forwarded-Proto}} / {{X-Forwarded-Host}} / {{X-Forwarded-Port}} request headers and stores it in the OAuth session. {{OAuthCodeFlowCallback}} later emits that value as the {{Location}} header of the post-login redirect.
> The reconstruction was added in CAMEL-21899 so that deployments behind an OpenShift Route/Ingress redirect to the externally reachable URL rather than the internally observed one. That behaviour must be preserved.
> The assembled origin is never compared against the deployment's own origin, so the forwarded header values are used as-is. The component should confine the result:
> * derive the expected origin from the configured {{CAMEL_OAUTH_REDIRECT_URI}}
> * accept the {{X-Forwarded-*}} reconstruction only when the resulting origin matches it
> * fall back to the configured origin otherwise
> Two smaller issues in the same method:
> * {{X-Forwarded-Host}} may be a comma-separated list when several proxies are chained ({{host1, host2}}); the current code concatenates the whole list into the URL and produces a malformed value.
> * The {{else}} branch returns {{Exchange.HTTP_URL}} unchanged, with no confinement either.
> h3. Affected code
> * {{components/camel-oauth/src/main/java/org/apache/camel/oauth/OAuthCodeFlowProcessor.java}} ({{getPostLoginUrl}})
> h3. Acceptance
> Unit tests covering a matching origin, a non-matching origin, a comma-separated {{X-Forwarded-Host}}, and absent forwarded headers.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)