[CXF-8692] CXF custom sensitive logging doesn't work on jaxrs and jaxws features blueprint declaration

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Not A Bug
• Affects Version/s: 3.4.7
• Component/s: JAX-RS, logging, WS-* Components
• Estimated Complexity: Unknown
• Assignee: Unassigned
• Reporter: Julien Greffe
• Created: 13/Apr/22 09:50
• Updated: 05/May/22 15:06
• Resolved: 05/May/22 15:06

Description

Hello,

we tried setting a custom sensitive logging using blueprint and following documentation https://cxf.apache.org/docs/message-logging.html.

This feature doesn't work when adding our bean/service in <jaxrs:features> or <jaxws:features> .
We have to declare the bean/service on <cxf:bus> level:

Not working;

<blueprint...>
    <jaxrs:server id="SAMRestService" address="/sam">
        <jaxrs:serviceBeans>
            <ref component-id="restService" />
        </jaxrs:serviceBeans>
        <jaxrs:features>
            <reference id="sensitiveLoggingFeature" interface="custom.security.logging.SensitiveLoggingFeature" />
       </jaxrs:features>
    </jaxrs:server>
</blueprint>

Working:

<blueprint...>
    <cxf:bus>
        <cxf:features>
            <reference id="sensitiveLoggingFeature" interface="custom.security.logging.SensitiveLoggingFeature" />
        </cxf:features>
    </cxf:bus>
    
    <jaxrs:server id="SAMRestService" address="/sam">
        <jaxrs:serviceBeans>
            <ref component-id="restService" />
        </jaxrs:serviceBeans>
    </jaxrs:server>
</blueprint>

It seems without explicit <cxf:bus> declaration, bus will have cxf:logging feature by default, and therefore will be used instead of custom one: https://github.com/apache/cxf/blob/cxf-3.4.7/rt/frontend/jaxrs/src/main/java/org/apache/cxf/jaxrs/JAXRSServerFactoryBean.java#L192-L193

See screenshot of stack:

• JAXRSServerFactoryBean has our custom logging feature >> not used
• bus has standard logging feature >> used