This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new ffab48ea514b CAMEL-25984: docs - upgrade guide entries for the
camel-cometd CORS filter credentials in 4.22.3 and 4.18.6 (#28504)
ffab48ea514b is described below
commit ffab48ea514bb3a0f779288eae7c6558a78f6f34
Author: Federico Mariani <[email protected]>
AuthorDate: Mon Oct 26 11:37:38 2026 +0100
CAMEL-25984: docs - upgrade guide entries for the camel-cometd CORS filter
credentials in 4.22.3 and 4.18.6 (#28504)
The fix is backported to camel-4.22.x and camel-4.18.x, so add the same
entry
as in the 4.24 upgrade guide under "Upgrading from 4.22.2 to 4.22.3" and
"Upgrading from 4.18.5 to 4.18.6".
---
.../modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc | 8 ++++++++
.../modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc | 8 ++++++++
2 files changed, 16 insertions(+)
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
index 90eb9954afce..ee013cda28ba 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_18.adoc
@@ -484,6 +484,14 @@ When configuring TLS through `SSLContextParameters` with a
standalone `TrustMana
When both a `TrustManager` and a keystore are configured on
`TrustManagersParameters`, the `TrustManager` is now used,
as with the other components that use `SSLContextParameters`; before, the
keystore-based trust options were used.
+=== camel-cometd - the CORS filter allows credentials only for listed origins
+
+With `crossOriginFilterOn=true`, the CORS responses now include
`Access-Control-Allow-Credentials: true` only when
+`allowedOrigins` lists the origins explicitly, without any `*` or `null`. When
`allowedOrigins` is not set, is `*`, or
+has an entry with a wildcard such as `https://*` or an entry `null`, the
origin is still allowed, but without
+credentials. Previously credentials were allowed for every origin. A
cross-origin client that sends cookies or other
+credentials must have its origin listed in `allowedOrigins`.
+
== Upgrading from 4.18.4 to 4.18.5
=== camel-azure-eventhubs
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
index 6a0110d37b70..934621f1cf42 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_22.adoc
@@ -291,6 +291,14 @@ When configuring TLS through `SSLContextParameters` with a
standalone `TrustMana
When both a `TrustManager` and a keystore are configured on
`TrustManagersParameters`, the `TrustManager` is now used,
as with the other components that use `SSLContextParameters`; before, the
keystore-based trust options were used.
+=== camel-cometd - the CORS filter allows credentials only for listed origins
+
+With `crossOriginFilterOn=true`, the CORS responses now include
`Access-Control-Allow-Credentials: true` only when
+`allowedOrigins` lists the origins explicitly, without any `*` or `null`. When
`allowedOrigins` is not set, is `*`, or
+has an entry with a wildcard such as `https://*` or an entry `null`, the
origin is still allowed, but without
+credentials. Previously credentials were allowed for every origin. A
cross-origin client that sends cookies or other
+credentials must have its origin listed in `allowedOrigins`.
+
== Upgrading from 4.22.1 to 4.22.2
=== camel-lra - only an LRA hosted by the configured coordinator is joined
