oscerd commented on code in PR #28512:
URL: https://github.com/apache/camel/pull/28512#discussion_r4377374214
##########
components/camel-oauth/src/main/java/org/apache/camel/oauth/OAuthSessionStore.java:
##########
@@ -25,4 +25,16 @@ public interface OAuthSessionStore {
Optional<OAuthSession> getSession(Exchange exchange);
OAuthSession createSession(Exchange exchange);
+
+ /**
+ * Rotates the session, replacing the current session identifier with a
newly generated one and transferring any
+ * session state.
+ *
+ * @param exchange the current exchange
+ * @param session the existing session to rotate
+ * @return the rotated session with a new session identifier
+ */
+ default OAuthSession rotateSession(Exchange exchange, OAuthSession
session) {
Review Comment:
Added the `@implNote` to `OAuthSessionStore.rotateSession` Javadoc warning
implementors that custom implementations must override the method to prevent
session fixation.
_Claude Code on behalf of oscerd_
##########
components/camel-oauth/src/main/java/org/apache/camel/oauth/InMemorySessionStore.java:
##########
@@ -62,21 +62,46 @@ public Optional<OAuthSession> getSession(Exchange exchange)
{
return maybeSession;
}
+ @Override
public OAuthSession createSession(Exchange exchange) {
var sessionId = UUID.randomUUID().toString();
var session = new InMemorySession(sessionId);
sessions.put(sessionId, session);
var msg = exchange.getMessage();
- log.info("New OAuthSession: {}", sessionId);
+ log.debug("New OAuthSession: {}", sessionId);
setSessionCookie(msg, session);
msg.setHeader(OAuth.CAMEL_OAUTH_SESSION_ID, sessionId);
return session;
}
+ @Override
+ public OAuthSession rotateSession(Exchange exchange, OAuthSession session)
{
+ if (session == null) {
+ return createSession(exchange);
+ }
+ var oldSessionId = session.getSessionId();
+ sessions.remove(oldSessionId);
+
+ var newSessionId = UUID.randomUUID().toString();
+ var newSession = new InMemorySession(newSessionId);
+ if (session instanceof InMemorySession inMemorySession) {
+ newSession.putAll(inMemorySession.getValues());
+ }
+ sessions.put(newSessionId, newSession);
+
+ var msg = exchange.getMessage();
+ log.debug("Rotated OAuthSession from {} to {}", oldSessionId,
newSessionId);
Review Comment:
Updated to `log.debug("Rotated OAuthSession")` so that session IDs are never
logged.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
