[
https://issues.apache.org/jira/browse/CAMEL-25638?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18127233#comment-18127233
]
Claus Ibsen commented on CAMEL-25638:
-------------------------------------
Merged to main in https://github.com/apache/camel/pull/27819. The fixVersions
also list 4.22.2 and 4.18.6, so this stays open for the backports.
_Claude Code on behalf of davsclaus_
> camel-graphql - bind accessToken and basic credentials to the configured
> httpUri authority
> ------------------------------------------------------------------------------------------
>
> Key: CAMEL-25638
> URL: https://issues.apache.org/jira/browse/CAMEL-25638
> Project: Camel
> Issue Type: Bug
> Components: camel-graphql
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.18.6, 4.22.2, 4.24.0
>
>
> camel-graphql configures authentication on its HTTP client itself, so the
> authority scoping that CAMEL-24452 added to camel-http does not apply to it:
> * {{accessToken}} (with {{jwtAuthorizationType}}) is installed with
> {{HttpClientBuilder.setDefaultHeaders(...)}}, so the {{Authorization}} header
> is added to every request the client executes, whatever its authority.
> * {{username}}/{{password}} are registered under {{new AuthScope(null, -1)}},
> which matches any scheme, host and port.
> Align it with camel-http:
> * register the basic credentials for the scheme, host and effective port of
> {{httpUri}};
> * attach the access token from a request interceptor, only when the request
> targets that authority (as {{OAuth2ClientConfigurer}} does since CAMEL-24452).
> Since CAMEL-22562 (4.19.0) the producer copies every message header into the
> internal camel-http exchange, so {{CamelHttpUri}}, {{CamelHttpPath}},
> {{CamelHttpQuery}} and {{CamelRestHttpUri}} now change the request URL, which
> camel-graphql did not do before. The internal endpoint should be created with
> {{skipControlHeaders=true}} so that the producer always addresses its
> configured {{httpUri}}.
> On camel-4.18.x the code is {{GraphqlEndpoint.createHttpClient()}} (the
> component builds its own client there), so the backport is a port rather than
> a cherry-pick.
> _Claude Code on behalf of oscerd_
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
