[jira] [Created] (CAMEL-24453) camel-platform-http - request-header echo suppression compares header names case-sensitively

["Andrea Cosentino (Jira)" <ji...@apache.org>]

Andrea Cosentino created CAMEL-24453:
----------------------------------------

             Summary: camel-platform-http - request-header echo suppression compares header names case-sensitively
                 Key: CAMEL-24453
                 URL: https://issues.apache.org/jira/browse/CAMEL-24453
             Project: Camel
          Issue Type: Bug
          Components: camel-platform-http
            Reporter: Andrea Cosentino
            Assignee: Andrea Cosentino
             Fix For: 4.23.0


{{PlatformHttpEndpoint.enhanceHeaderFilterStrategyToSkipHttpRequestHeaders()}} wraps the endpoint's {{HeaderFilterStrategy}} so that request headers are not echoed back on the response. Its {{applyFilterToCamelHeaders}} returns true only when {{COMMON_HTTP_REQUEST_HEADERS.contains(headerName)}} - an exact-case lookup against a canonically capitalised set ({{"Authorization"}}, {{"Cookie"}}, ...).

Exchange headers keep the casing of the inbound request: {{VertxPlatformHttpConsumer}} populates them from the Vert.x {{MultiMap}} as received. HTTP/2 mandates lower-case field names, so on an HTTP/2 request the names are {{authorization}}, {{cookie}} and so on, none of which match the set. {{VertxPlatformHttpSupport.copyMessageHeadersToResponse}} then writes them to the response.

The suppression therefore never fires for HTTP/2 traffic, and does not fire for any client that varies the casing.

Proposal: compare case-insensitively - a {{TreeSet}} with {{String.CASE_INSENSITIVE_ORDER}}, or lower-case both sides at the lookup.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)