From 91aa0bfc69ce3a8972ac121ec4183923669b4c69 Mon Sep 17 00:00:00 2001 From: Andrea Cosentino Date: Mon, 25 May 2026 11:49:37 +0200 Subject: [PATCH] CAMEL-23592: camel-shiro - align Exchange header constant names with Camel naming convention Renames the three Exchange header string values in ShiroSecurityConstants that drive Shiro authentication (SHIRO_SECURITY_TOKEN, SHIRO_SECURITY_USERNAME, SHIRO_SECURITY_PASSWORD) to CamelShiroSecurity, following the convention used across the rest of the Camel component catalog and matching the pattern established in CAMEL-23526 (camel-cxf), CAMEL-23522 (camel-mail), CAMEL-23461 (camel-aws-bedrock), CAMEL-23532 (camel-vertx-websocket / camel-atmosphere-websocket / camel-iggy), and CAMEL-23576 (camel-jira). - SHIRO_SECURITY_TOKEN: "SHIRO_SECURITY_TOKEN" -> "CamelShiroSecurityToken" - SHIRO_SECURITY_USERNAME: "SHIRO_SECURITY_USERNAME" -> "CamelShiroSecurityUsername" - SHIRO_SECURITY_PASSWORD: "SHIRO_SECURITY_PASSWORD" -> "CamelShiroSecurityPassword" These headers carry credentials and a serialized authentication token, so filtering them at transport boundaries by default is particularly important. The Java field names are unchanged so routes referencing the constants symbolically continue to work; routes using the literal string values must be updated (documented in the 4.21 upgrade guide). No tests reference the literal values, and the shiro adoc documentation references the constants symbolically. Tracker: CAMEL-23577 Reported by Claude Code on behalf of Andrea Cosentino Signed-off-by: Andrea Cosentino --- .../security/ShiroSecurityConstants.java | 6 ++--- .../pages/camel-4x-upgrade-guide-4_21.adoc | 27 +++++++++++++++++++ 2 files changed, 30 insertions(+), 3 deletions(-) diff --git a/components/camel-shiro/src/main/java/org/apache/camel/component/shiro/security/ShiroSecurityConstants.java b/components/camel-shiro/src/main/java/org/apache/camel/component/shiro/security/ShiroSecurityConstants.java index b3b30e800efac..4f8e7d21e5adf 100644 --- a/components/camel-shiro/src/main/java/org/apache/camel/component/shiro/security/ShiroSecurityConstants.java +++ b/components/camel-shiro/src/main/java/org/apache/camel/component/shiro/security/ShiroSecurityConstants.java @@ -21,9 +21,9 @@ */ public final class ShiroSecurityConstants { - public static final String SHIRO_SECURITY_TOKEN = "SHIRO_SECURITY_TOKEN"; - public static final String SHIRO_SECURITY_USERNAME = "SHIRO_SECURITY_USERNAME"; - public static final String SHIRO_SECURITY_PASSWORD = "SHIRO_SECURITY_PASSWORD"; + public static final String SHIRO_SECURITY_TOKEN = "CamelShiroSecurityToken"; + public static final String SHIRO_SECURITY_USERNAME = "CamelShiroSecurityUsername"; + public static final String SHIRO_SECURITY_PASSWORD = "CamelShiroSecurityPassword"; private ShiroSecurityConstants() { } diff --git a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_21.adoc b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_21.adoc index 71ad189092add..e924b5af7c5e6 100644 --- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_21.adoc +++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_21.adoc @@ -849,6 +849,33 @@ directions, aligning the component with the rest of the Camel component catalog. `Camel`-prefixed user-header names from Iggy messages can supply a custom `headerFilterStrategy` to restore the previous behaviour. +=== camel-shiro - potential breaking change + +The three Exchange header constants in `ShiroSecurityConstants` that drive +Shiro authentication used header values outside the `Camel` namespace +(`SHIRO_SECURITY_TOKEN`, `SHIRO_SECURITY_USERNAME`, `SHIRO_SECURITY_PASSWORD`) +and were therefore not filtered by the default `HeaderFilterStrategy`. They +have been renamed to follow the Camel naming convention. The Java field names +are unchanged; only the header string values have changed: + +[options="header"] +|=== +| Constant | Previous value | New value +| `ShiroSecurityConstants.SHIRO_SECURITY_TOKEN` | `SHIRO_SECURITY_TOKEN` | `CamelShiroSecurityToken` +| `ShiroSecurityConstants.SHIRO_SECURITY_USERNAME` | `SHIRO_SECURITY_USERNAME` | `CamelShiroSecurityUsername` +| `ShiroSecurityConstants.SHIRO_SECURITY_PASSWORD` | `SHIRO_SECURITY_PASSWORD` | `CamelShiroSecurityPassword` +|=== + +These headers carry credentials and a serialized authentication token, so +filtering them at transport boundaries by default is particularly important. + +Routes that reference the constants symbolically (for example +`setHeader(ShiroSecurityConstants.SHIRO_SECURITY_USERNAME, ...)`) continue to +work without changes. Routes that set the header by its literal string value +(for example `setHeader("SHIRO_SECURITY_USERNAME", ...)`) must be updated to +use the new value (`setHeader("CamelShiroSecurityUsername", ...)`). + + === camel-web3j - potential breaking change The Exchange header constants in `Web3jConstants` have been renamed to follow the