Hi,
I have a bit regression under 2.7.7 because of changes in
SoapActionInInterceptor
(https://fisheye6.atlassian.com/changelog/cxf?cs=1368559 )
SoapActionInInterceptor requires that the SOAPAction exactly matches to the
service operation.
The problem is that there are some scenarios where the proxies using Provider<>
API process requests from different clients with any SOAPAction.
If you don't see security issue in that, I would ignore the check if
SoapOperationInfo action has default SOAP action (configured as empty in
SoapBindingConfiguration):
Instead:
SoapOperationInfo soi = boi.getExtensor(SoapOperationInfo.class);
if (soi == null || action.equals(soi.getAction())) {
return;
}
Will be:
SoapOperationInfo soi = boi.getExtensor(SoapOperationInfo.class);
if ((soi == null) || StringUtils.isEmpty(soi.getAction()) ||
action.equals(soi.getAction())) {
return;
}
WDYT?
Regards,
Andrei.