Repository navigation
CAMEL-25994: camel-undertow - WebSocket: keep the OAuth validation of a connection per endpoint, like the other security checks - #28297
Conversation
|
🌟 Thank you for your contribution to the Apache Camel project! 🌟 🐫 Apache Camel Committers, please review the following items:
|
gnodet-bot
left a comment
gnodet-bot
left a comment
There was a problem hiding this comment.
LGTM. The fix correctly scopes OAuth validation per endpoint rather than globally across the path.
The oauthEndpoints set is populated during the upgrade handshake and carried in HandshakeResult.oauthEndpointUris. The new isOAuthValidated() then requires the current endpoint's URI to be in that set — so a connection validated by oauthProfile=first is correctly rejected by oauthProfile=second when the consumer changes. The channel-null case is handled correctly: isOAuthValidated returns false when channel == null, preserving the original null-guard behavior.
The test is well-structured. The 1008 close on firstWebSocket.sendText() is triggered by UndertowConsumer.rejectUnauthenticatedWebSocketChannel() which calls CamelWebSocketHandler.isAuthenticated(channel, getEndpoint()) — that's the public single-arg overload routed through the new isOAuthValidated. The test correctly exercises the fixed code path.
Pre-fix validation: sendText() → onFullTextMessage() → consumer.sendMessage() → rejectUnauthenticatedWebSocketChannel() → isAuthenticated() → isOAuthValidated() — the method modified by the fix. The test assertion (MSG_VIOLATES_POLICY close code + empty first.received) would only pass if isOAuthValidated returns false for the endpoint whose URI was not stored during the original handshake, which it does without the fix. Confirmed red-without-fix by static trace.
Backport label port/camel-4.22.x is correctly set — camel-4.18.x does not have WebSocket oauthProfile support so LTS backport is not applicable.
This review was generated by an AI agent, Hermès on behalf of @gnodet.
|
🧪 CI tested the following changed modules:
🔬 Scalpel shadow comparison — Scalpel: 46 of 707 tested, 27 compile-only — current: 46 all testedMaveniverse Scalpel detected 46 affected modules (current approach: 46). Skip-tests mode would test 46 modules (1 direct + 45 downstream), skip tests for 27 (generated code, meta-modules) Modules Scalpel would test (46)
Modules with tests skipped (27)
|
… a connection per endpoint, like the other security checks Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Claus Ibsen <claus.ibsen@gmail.com>
71ab31b to
45b7ec3
Compare
🔄 Backport BotConflicts (🤖 agent dispatched to resolve):
ℹ️ If you push additional commits after |
|
✅ Backport to |
CAMEL-25994
CamelWebSocketHandlerrecords, for each WebSocket connection, which endpoints of the path the handshake was checked against: the security provider, the allowed roles and the custom handlers of a consumer are kept per endpoint URI. The result of theoauthProfilevalidation was kept without the endpoint that did the validation, so the later checks of an open connection only saw that some OAuth validation had happened.Changes:
isAuthenticatedrequires the OAuth validation of the endpoint whose settings currently apply to the path. A connection validated by another endpoint no longer passes the checks of the path: it is closed with 1008 as soon as the new consumer is set (by theclosePeersThatNoLongerPassChecksof CAMEL-25917: camel-undertow - a WebSocket connection accepted while only a producer served the path is not treated as having passed a later consumer's custom handlers #28237), and until then it is not sent messages nor served.UndertowWsOAuthProfileConsumerChangeTest: a producer route keeps the path registered while the consumer is replaced by one with another OAuth profile. The old connection is closed when the new consumer starts, and the new one keeps working. It fails without the change.Notes:
mainafter CAMEL-25917: camel-undertow - a WebSocket connection accepted while only a producer served the path is not treated as having passed a later consumer's custom handlers #28237 (CAMEL-25917):HandshakeResultkeeps both itsconsumerflag and the OAuth endpoints, and the test now expects the close when the consumer starts, instead of when the old connection next sends.camel-4.22.x(WebSocketoauthProfilecame in 4.21), so this should be backported there.camel-4.18.xdoes not have it.Tests:
mvn verifyincomponents/camel-undertowpasses locally after the rebase (239 tests, 1 skipped).Claude Code on behalf of @davsclaus
🤖 Generated with Claude Code