[
https://issues.apache.org/jira/browse/CAMEL-25578?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18127065#comment-18127065
]
Claus Ibsen commented on CAMEL-25578:
-------------------------------------
Backported to camel-4.18.x in https://github.com/apache/camel/pull/27811. The
camel-4.22.x backport (https://github.com/apache/camel/pull/27804) is still
open.
_Claude Code on behalf of
> camel-lra - verify participant callbacks with an optional shared secret
> -----------------------------------------------------------------------
>
> Key: CAMEL-25578
> URL: https://issues.apache.org/jira/browse/CAMEL-25578
> Project: Camel
> Issue Type: Improvement
> Components: camel-lra
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.18.6, 4.22.2, 4.24.0
>
>
> The LRA participant routes ({{PUT <localParticipantContextPath>/compensate}}
> and {{/complete}}) take the saga step endpoint and the saga options from the
> callback URL enlisted with the LRA coordinator.
> Add an optional shared secret to the LRA saga service so the participant can
> sign the callback URLs it enlists and verify them when the coordinator calls
> back:
> * new {{LRASagaService}} option, also settable as {{camel.lra.callbackSecret}}
> * when set: the compensate/complete URLs carry an HMAC-SHA256 signature over
> the callback type and all query parameters; callbacks with a missing or
> mismatching signature get HTTP 403, and only the signed values are passed on
> to the step endpoint
> * when not set: behaviour unchanged, plus a startup warning
> * docs: the Saga EIP / LRA pages describe the participant endpoints, that
> they are meant to be reachable by the coordinator, and the new option
> Follow-up: expose the option in {{camel-lra-starter}} (camel-spring-boot).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
