CAMEL-24436/24450/24452/24456: CORS and credential scoping fixes, backport to camel-4.22.x - #25937

Merged

Croway merged 4 commits into

apache:camel-4.22.xfrom

oscerd:backport/glasswing-cors-credentials-4.22.x

Aug 31, 2026

Commits on Aug 31, 2026

CAMEL-24456: camel-http - key the OAuth2 token cache on every field that shapes the token (#25834)

oscerd
and
claude
committed
90bd2a0
CAMEL-24450: camel-jetty - do not grant CORS credentials to an origin the operator did not name (#25829)

oscerd
and
claude
committed
3ec9dc0
CAMEL-24452: camel-http - do not send credentials to an authority the endpoint was not configured with (#25830)

oscerd
and
claude
committed
c8ce434
CAMEL-24436: camel-platform-http-vertx - only allow CORS credentials for a configured origin (#25820)

oscerd
and
claude
committed
9599d6b