[CXF-8010] Avoid applying the SAAJInInterceptor to unsecured messages when using WS-SecurityPolicy

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.3.2
• Estimated Complexity: Unknown
• Assignee: Colm O hEigeartaigh
• Reporter: Colm O hEigeartaigh
• Created: 03/Apr/19 13:26
• Updated: 13/May/19 18:08
• Resolved: 03/Apr/19 14:31

Description

It's possible to have a scenario where certain operations are secured using a WS-SecurityPolicy, and some are not secured at all. Up til now, the WSS4JInInterceptor will convert all messages to DOM form for WS-Security processing, using the SAAJInInterceptor.

With this fix, if a message does not contain a security header, it will not be converted using the SAAJInIntereptor. Instead the policies are evaluated against an empty set. This should result in a performance boost for the insecured message case. Note that this only applies when using WS-SecurityPolicy, and not using the plain WSS4JInInterceptor with "action" configuration.