[
https://issues.apache.org/jira/browse/CXF-4629?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13496475#comment-13496475
]
Oleh Faizulin commented on CXF-4629:
------------------------------------
Freeman,
I don't get what do you mean by *could you please post the on-wire request
message*.
I just start browser, write
{noformat}http://localhost:8181/ls/api/test?a=10&b=20{noformat}
press enter and get result from web service.
Anyway, to fix the problem we introduced our custom interceptor.
{noformat}
<jaxws:inInterceptors>
<bean class="com.ourpackage.RequestFilterInterceptor" />
<---- This one
<bean class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor" />
<bean class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
{noformat}
{noformat}
/**
* @author Aquanox
* @date 13.11.2012 14:46
*/
public class RequestFilterInterceptor extends AbstractWSS4JInterceptor {
public RequestFilterInterceptor() {
super();
setPhase(Phase.PRE_PROTOCOL);
}
@Override
public void handleMessage(SoapMessage message) throws Fault {
if (message.getContent(SOAPMessage.class) == null) {
throw createSoapFault(message.getVersion(), new
WSSecurityException(WSSecurityException.INVALID_SECURITY));
}
}
/**
* Create a SoapFault from a WSSecurityException, following the SOAP
Message Security
* 1.1 specification, chapter 12 "Error Handling".
*
* When the Soap version is 1.1 then set the Fault/Code/Value from the
fault code
* specified in the WSSecurityException (if it exists).
*
* Otherwise set the Fault/Code/Value to env:Sender and the
Fault/Code/Subcode/Value
* as the fault code from the WSSecurityException.
*/
private SoapFault createSoapFault(SoapVersion version, WSSecurityException
e) {
SoapFault fault;
javax.xml.namespace.QName faultCode = e.getFaultCode();
if (version.getVersion() == 1.1 && faultCode != null) {
fault = new SoapFault(e.getMessage(), e, faultCode);
} else {
fault = new SoapFault(e.getMessage(), e, version.getSender());
if (version.getVersion() != 1.1 && faultCode != null) {
fault.setSubCode(faultCode);
}
}
return fault;
}
}
{noformat}
> Security issue with GET methods: WSS4JInInterceptor always allows HTTP Get
> requests from browser
> ------------------------------------------------------------------------------------------------
>
> Key: CXF-4629
> URL: https://issues.apache.org/jira/browse/CXF-4629
> Project: CXF
> Issue Type: Bug
> Components: WS-* Components
> Affects Versions: 2.6.3, 2.7.0
> Reporter: Oleh Faizulin
> Priority: Critical
>
> Hello All,
> We are running CFX web services with the following configuration:
> web.xml
> {noformat}
> <servlet>
> <servlet-name>cxf</servlet-name>
>
> <servlet-class>org.apache.cxf.transport.servlet.CXFServlet</servlet-class>
> <load-on-startup>1</load-on-startup>
> </servlet>
> <servlet-mapping>
> <servlet-name>cxf</servlet-name>
> <url-pattern>/ls/*</url-pattern>
> </servlet-mapping>
> {noformat}
> spring config:
> {noformat}
> <!-- ######################################### -->
> <beans:import resource="classpath:META-INF/cxf/cxf.xml" />
> <beans:import resource="classpath:META-INF/cxf/cxf-servlet.xml" />
> <beans:import resource="classpath:META-INF/cxf/cxf-extension-soap.xml" />
> <jaxws:endpoint id="lsWebEndpoint"
> implementor="${our endpoint class}"
> address="/api" >
> <jaxws:inInterceptors>
> <bean class="org.apache.cxf.binding.soap.saaj.SAAJInInterceptor"
> />
> <bean class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
> <constructor-arg>
> <map>
> <entry key="action" value="UsernameToken"/>
> <entry key="passwordType" value="PasswordText"/>
> <entry key="passwordCallbackClass" value="${our
> password callback impl}"/>
> </map>
> </constructor-arg>
> </bean>
> </jaxws:inInterceptors>
> </jaxws:endpoint>
> {noformat}
> And we discovered that all our web services are accessible via browser (HTTP
> Get) without any authentication.
> For instance:
> {noformat}
> http://localhost:8181/ls/api/test?a=10&b=20
> {noformat}
> {noformat}
> @WebService
> public class WSEndpoint {
> @WebMethod
> public int test(@WebParam(name = "a") int a,
> @WebParam(name = "b") int b) {
> return a + b;
> }
> }
> {noformat}
> returns
> {noformat}
> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/";>
> <soap:Body>
> <ns2:testResponse xmlns:ns2="${our namespace}">
> <return>30</return>
> </ns2:testResponse>
> </soap:Body>
> </soap:Envelope>
> {noformat}
> The reason is the following code in WSS4JInInterceptor:
> {noformat}
> public final boolean isGET(SoapMessage message) {
> String method = (String)message.get(SoapMessage.HTTP_REQUEST_METHOD);
> return "GET".equals(method) &&
> message.getContent(XMLStreamReader.class) == null;
> }
>
> public void handleMessage(SoapMessage msg) throws Fault {
> if (msg.containsKey(SECURITY_PROCESSED) || isGET(msg)) {
> return;
> }:
> ...
> {noformat}
> I was not able to find anything specific on google why GET methods are always
> allowed.
> However it's somehow related to CXF-3170:
> Please see
> http://cxf.547215.n5.nabble.com/svn-commit-r1062014-in-cxf-branches-2-3-x-fixes-rt-ws-security-src-main-java-org-apache-cxf-ws-secura-tt3352201.html#none
> Also i found the following thread on StackOverflow without answer:
> http://stackoverflow.com/questions/7933293/why-does-apache-cxf-ws-security-implementation-ignore-get-requests
> Please advice on this this issue.
> Regards,
> Oleh.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
