[CXF-4056] Faults on server are echoing headers back to the client

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.5.2
• Fix Version/s: 2.3.10, 2.4.7, 2.5.3
• Component/s: Soap Binding
• Estimated Complexity: Unknown
• Assignee: Daniel Kulp
• Reporter: Daniel Kulp
• Created: 23/Jan/12 18:36
• Updated: 23/Apr/12 16:45
• Resolved: 23/Jan/12 20:27

Description

The SoapHeaderOutFilterInterceptor that filters out the incoming headers is only installed on the Out chain. It's not installed on the OutFault chain. Thus, all the incoming headers are echoed back to the client which could result in WS-Addressing issues, security issues, etc...