allthingssecurity commented on PR #27589: URL: https://github.com/apache/camel/pull/27589#issuecomment-6077830062
@davsclaus on the open question: agreed, the default is now `HOST_ONLY` (a9d510ea24db). The token request never includes the request URI, and `FULL_URI` made the JVM-wide cache, which is never pruned, grow by one entry per distinct URI with `toD`. The client id, client secret, token endpoint, scope and resource indicator stay in the key, and the CAMEL-24452 authority check is unchanged, so a token is not shared across a different client, scope or host. The 4.23 upgrade guide has a new entry "OAuth2 cached tokens are shared per host" under camel-http, and `oauth2CachedTokensKey=FULL_URI` restores the old behaviour. The tests now pin the new default and keep `FULL_URI` covered explicitly; camel-http: 279 tests, 0 failures, 9 skipped. @oscerd, thanks. Your points 1 to 4 are the same as Claus's inline comments, answered there. 5: `FULL_URI` compares the URI as written; ac94275d56cc says so in its Javadoc (URIs that differ only in the case of the scheme or host get separate tokens), and with `HOST_ONLY` as the default it only matters for users who opt in to `FULL_URI`. 6: resolved as above. `@since 4.23` is added to both new public types. _Claude Code on behalf of allthingssecurity_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
