You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "oscerd (via GitHub)" <gi...@apache.org> on 2026/08/31 08:12:00 UTC
[PR] CAMEL-24436/24450/24452/24456: CORS and credential scoping fixes, backport to camel-4.22.x [camel]
oscerd opened a new pull request, #25937:
URL: https://github.com/apache/camel/pull/25937
Backport to `camel-4.22.x` of four fixes already reviewed and merged on `main`. All four are about a credential or a CORS grant reaching a party the operator never named.
- CAMEL-24456: camel-http - key the OAuth2 token cache on every field that shapes the token (#25834, `4e2ddabd`)
- CAMEL-24450: camel-jetty - do not grant CORS credentials to an origin the operator did not name (#25829, `6e3e4ec5`)
- CAMEL-24452: camel-http - do not send credentials to an authority the endpoint was not configured with (#25830, `3a6c27bf`)
- CAMEL-24436: camel-platform-http-vertx - only allow CORS credentials for a configured origin (#25820, `4b557e4e`)
Straight cherry-picks, applied in the order they merged on `main`, with no manual conflict resolution. The upgrade-guide entries are not included: the guides for every line live on `main`.
**Behaviour changes to be aware of when upgrading a patch release:**
- `enableCORS=true` on jetty no longer installs Jetty's allow-all `CrossOriginFilter` defaults. A deployment that relied on any origin being accepted must now name its origins.
- platform-http-vertx sends `Access-Control-Allow-Credentials` only when the request origin matched a configured origin. With no origin list the origin is still reflected as before, but credentials are not granted, and `Vary: Origin` is now set.
- camel-http stops re-attaching `Authorization` on cross-authority redirects when `followRedirects=true`.
Built and tested per module on this branch (`camel-http`, `camel-jetty-common`, `camel-jetty`, `camel-platform-http-vertx`), including the new and touched tests: `HttpOAuth2TokenCachingTest`, `HttpOAuth2RedirectTokenLeakTest`, `HttpClientConfigurerOverrideTest`, `EnableCORSTest`, `VertxPlatformHttpEngineTest`.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-24436/24450/24452/24456: CORS and credential scoping fixes, backport to camel-4.22.x [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #25937:
URL: https://github.com/apache/camel/pull/25937#issuecomment-5476095708
<!-- ci-tested-modules -->
:test_tube: **CI tested the following changed modules:**
- `components/camel-http`
- `components/camel-jetty-common`
- `components/camel-jetty`
- `components/camel-platform-http-vertx`
> :information_source: Dependent modules were not tested because the total number of affected modules exceeded the threshold (50). Use the `test-dependents` label to force testing all dependents.
---
<details><summary>:microscope: Scalpel shadow comparison — Scalpel: 63 tested, 29 compile-only — current: 63 all tested</summary>
[Maveniverse Scalpel](https://github.com/maveniverse/scalpel) detected **92 affected modules** (current approach: 63).
<details><summary>:warning: Modules only in Scalpel (29)</summary>
- `apache-camel`
- `camel-allcomponents`
- `camel-catalog`
- `camel-catalog-console`
- `camel-catalog-lucene`
- `camel-catalog-maven`
- `camel-catalog-suggest`
- `camel-componentdsl`
- `camel-csimple-maven-plugin`
- `camel-endpointdsl`
- `camel-endpointdsl-support`
- `camel-itest`
- `camel-jbang-core`
- `camel-jbang-it`
- `camel-jbang-main`
- `camel-jbang-plugin-edit`
- `camel-jbang-plugin-generate`
- `camel-jbang-plugin-kubernetes`
- `camel-jbang-plugin-test`
- `camel-kamelet-main`
- `camel-launcher`
- `camel-report-maven-plugin`
- `camel-route-parser`
- `camel-yaml-dsl`
- `camel-yaml-dsl-deserializers`
- `camel-yaml-dsl-maven-plugin`
- `coverage`
- `docs`
- `dummy-component`
</details>
**Skip-tests mode would test 63 modules** (4 direct + 59 downstream), **skip tests for 29** (generated code, meta-modules)
<details><summary>Modules Scalpel would test (63)</summary>
- `camel-a2a`
- `camel-as2`
- `camel-clickup`
- `camel-consul`
- `camel-cxf-rest`
- `camel-cxf-soap`
- `camel-cxf-spring-rest`
- `camel-cxf-spring-soap`
- `camel-cxf-spring-transport`
- `camel-cxf-transport`
- `camel-graphql`
- `camel-http`
- `camel-java-joor-dsl`
- `camel-jbang-mcp`
- `camel-jbang-plugin-mcp`
- `camel-jbang-plugin-route-parser`
- `camel-jbang-plugin-tui`
- `camel-jbang-plugin-validate`
- `camel-jetty`
- `camel-jetty-common`
- `camel-jsonpath`
- `camel-kamelet`
- `camel-knative-http`
- `camel-kubernetes`
- `camel-launcher-container`
- `camel-lra`
- `camel-mcp-server`
- `camel-micrometer-observability`
- `camel-micrometer-prometheus`
- `camel-netty-http`
- `camel-oauth`
- `camel-observability-services`
- `camel-openapi-validator`
- `camel-opentelemetry`
- `camel-opentelemetry2`
- `camel-platform-http`
- `camel-platform-http-jolokia`
- `camel-platform-http-main`
- `camel-platform-http-vertx`
- `camel-quickfix`
- `camel-rest-openapi`
- `camel-restdsl-openapi-plugin`
- `camel-sap-netweaver`
- `camel-slack`
- `camel-soap`
- `camel-spring-rabbitmq`
- `camel-telegram`
- `camel-telemetry`
- `camel-telemetry-dev`
- `camel-test-main-junit5`
- `camel-test-main-junit6`
- `camel-undertow`
- `camel-undertow-spring-security`
- `camel-vertx-http`
- `camel-webhook`
- `camel-whatsapp`
- `camel-xml-io-dsl`
- `camel-xml-jaxb-dsl`
- `camel-xml-jaxb-dsl-test-definition`
- `camel-xml-jaxb-dsl-test-spring`
- `camel-yaml-dsl-validator`
- `camel-yaml-dsl-validator-maven-plugin`
- `camel-zookeeper`
</details>
<details><summary>Modules with tests skipped (29)</summary>
- `apache-camel`
- `camel-allcomponents`
- `camel-catalog`
- `camel-catalog-console`
- `camel-catalog-lucene`
- `camel-catalog-maven`
- `camel-catalog-suggest`
- `camel-componentdsl`
- `camel-csimple-maven-plugin`
- `camel-endpointdsl`
- `camel-endpointdsl-support`
- `camel-itest`
- `camel-jbang-core`
- `camel-jbang-it`
- `camel-jbang-main`
- `camel-jbang-plugin-edit`
- `camel-jbang-plugin-generate`
- `camel-jbang-plugin-kubernetes`
- `camel-jbang-plugin-test`
- `camel-kamelet-main`
- `camel-launcher`
- `camel-report-maven-plugin`
- `camel-route-parser`
- `camel-yaml-dsl`
- `camel-yaml-dsl-deserializers`
- `camel-yaml-dsl-maven-plugin`
- `coverage`
- `docs`
- `dummy-component`
</details>
> :information_source: Shadow mode — Scalpel observes but does not affect test execution. [Learn more](https://github.com/maveniverse/scalpel)
</details>
:warning: **Some tests are disabled on GitHub Actions** (`@DisabledIfSystemProperty(named = "ci.env.name")`) and require manual verification:
- `components/camel-jetty`: 1 test(s) disabled on GitHub Actions
<details><summary>Build reactor — dependencies compiled but only changed modules were tested (92 modules)</summary>
- Camel :: AI :: A2A
- Camel :: AI :: MCP Server
- Camel :: AS2 :: Component
- Camel :: All Components Sync point
- Camel :: Assembly
- Camel :: CXF :: REST
- Camel :: CXF :: REST :: Spring
- Camel :: CXF :: SOAP
- Camel :: CXF :: SOAP :: Spring
- Camel :: CXF :: Transport
- Camel :: CXF :: Transport :: Spring
- Camel :: Catalog :: CSimple Maven Plugin (deprecated)
- Camel :: Catalog :: Camel Catalog
- Camel :: Catalog :: Camel Report Maven Plugin
- Camel :: Catalog :: Camel Route Parser
- Camel :: Catalog :: Console
- Camel :: Catalog :: Dummy Component
- Camel :: Catalog :: Lucene (deprecated)
- Camel :: Catalog :: Maven
- Camel :: Catalog :: Suggest
- Camel :: ClickUp
- Camel :: Common Telemetry
- Camel :: Component DSL
- Camel :: Consul
- Camel :: Coverage
- Camel :: Docs
- Camel :: Endpoint DSL
- Camel :: Endpoint DSL :: Support
- Camel :: GraphQL
- Camel :: HTTP
- Camel :: Integration Tests
- Camel :: JBang :: Core
- Camel :: JBang :: Integration tests
- Camel :: JBang :: MCP
- Camel :: JBang :: Main
- Camel :: JBang :: Plugin :: Edit
- Camel :: JBang :: Plugin :: Generate
- Camel :: JBang :: Plugin :: Kubernetes
- Camel :: JBang :: Plugin :: MCP
- Camel :: JBang :: Plugin :: Route Parser
- Camel :: JBang :: Plugin :: TUI
- Camel :: JBang :: Plugin :: Testing
- Camel :: JBang :: Plugin :: Validate
- Camel :: JSon Path
- Camel :: Java DSL with jOOR
- Camel :: Jetty
- Camel :: Jetty :: Common
- Camel :: Kamelet
- Camel :: Kamelet Main
- Camel :: Knative HTTP
- Camel :: Kubernetes
- Camel :: Launcher
- Camel :: Launcher :: Container
- Camel :: Long-Running-Action
- Camel :: Maven Plugins :: OpenApi REST DSL Generator
- Camel :: Micrometer :: Observability 2
- Camel :: Micrometer :: Prometheus
- Camel :: Netty HTTP
- Camel :: OAuth
- Camel :: Observability Services
- Camel :: OpenAPI :: Validator
- Camel :: OpenTelemetry (deprecated)
- Camel :: Opentelemetry 2
- Camel :: Platform HTTP
- Camel :: Platform HTTP :: Jolokia
- Camel :: Platform HTTP :: Main
- Camel :: Platform HTTP :: Vert.x
- Camel :: QuickFIX/J
- Camel :: REST OpenApi
- Camel :: SAP NetWeaver
- Camel :: SOAP
- Camel :: Slack
- Camel :: Spring RabbitMQ
- Camel :: Telegram
- Camel :: Telemetry :: Dev
- Camel :: Test :: Main :: JUnit5
- Camel :: Test :: Main :: JUnit6
- Camel :: Undertow
- Camel :: Undertow Spring Security
- Camel :: Vert.x :: HTTP
- Camel :: Webhook
- Camel :: Whatsapp
- Camel :: XML DSL Jaxb :: Test :: Definition
- Camel :: XML DSL Jaxb :: Test :: Spring
- Camel :: XML DSL with camel-xml-io
- Camel :: XML DSL with camel-xml-jaxb
- Camel :: YAML DSL
- Camel :: YAML DSL :: Deserializers
- Camel :: YAML DSL :: Maven Plugins
- Camel :: YAML DSL :: Validator
- Camel :: YAML DSL :: Validator Maven Plugin
- Camel :: Zookeeper
</details>
---
:gear: [View full build and test results](https://github.com/apache/camel/actions/runs/33371774791)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-24436/24450/24452/24456: CORS and credential scoping fixes, backport to camel-4.22.x [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #25937:
URL: https://github.com/apache/camel/pull/25937#issuecomment-5475639105
:star2: Thank you for your contribution to the Apache Camel project! :star2:
:robot: CI automation will test this PR automatically.
:camel: Apache Camel Committers, please review the following items:
* First-time contributors **require MANUAL approval** for the GitHub Actions to run
* You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
* You can label PRs using `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
* Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
:warning: Be careful when sharing logs. Review their contents before sharing them publicly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-24436/24450/24452/24456: CORS and credential scoping fixes, backport to camel-4.22.x [camel]
Posted by "Croway (via GitHub)" <gi...@apache.org>.
Croway merged PR #25937:
URL: https://github.com/apache/camel/pull/25937
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org