You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by bu...@apache.org on 2026/06/10 01:42:57 UTC
svn commit: r1093226 - in websites/production/cxf/content: cache docs
Author: buildbot
Date: Wed Jun 10 01:42:57 2026
New Revision: 1093226
Log:
Production update by buildbot for cxf
Modified:
websites/production/cxf/content/cache/docs.pageCache
websites/production/cxf/content/docs/securing-cxf-services.html
Modified: websites/production/cxf/content/cache/docs.pageCache
==============================================================================
Binary file (source and/or target). No diff available.
Modified: websites/production/cxf/content/docs/securing-cxf-services.html
==============================================================================
--- websites/production/cxf/content/docs/securing-cxf-services.html Tue Jun 9 18:47:06 2026 (r1093225)
+++ websites/production/cxf/content/docs/securing-cxf-services.html Wed Jun 10 01:42:57 2026 (r1093226)
@@ -94,7 +94,8 @@ Apache CXF -- Securing CXF Services
<div id="wrapper-menu-page-bottom">
<div id="menu-page">
<!-- NavigationBar -->
-<div id="navigation"><ul class="alternate"><li><a shape="rect" href="overview.html">Overview</a></li><li><a shape="rect" href="how-tos.html">How-Tos</a></li><li><a shape="rect" href="frontends.html">Frontends</a></li><li><a shape="rect" href="databindings.html">DataBindings</a></li><li><a shape="rect" href="transports.html">Transports</a></li><li><a shape="rect" href="configuration.html">Configuration</a></li><li><a shape="rect" href="debugging-and-logging.html">Debugging and Logging</a></li><li><a shape="rect" href="tools.html">Tools</a></li><li><a shape="rect" href="restful-services.html">RESTful Services</a></li><li><a shape="rect" href="wsdl-bindings.html">WSDL Bindings</a></li><li><a shape="rect" href="service-routing.html">Service Routing</a></li><li><a shape="rect" href="dynamic-languages.html">Dynamic Languages</a></li><li><a shape="rect" href="ws-support.html">WS-* Support</a></li><li><a shape="rect" href="advanced-integration.html">Advanced Integration</a></li><li><a shape
="rect" href="deployment.html">Deployment</a></li><li><a shape="rect" href="schemas-and-namespaces.html">Use of Schemas and Namespaces</a></li><li><a shape="rect" href="securing-cxf-services.html">Securing CXF Services</a></li></ul><hr><ul class="alternate"><li><p>Search</p></li></ul><iframe frameborder="1" scrolling="auto" id="searchId" src="https://cxf.apache.org/resources/search.htm" name="SearchIFrame" width="200px" style="border:none;" title="Search" height="60px"><p><br clear="none"></p></iframe>
+<div id="navigation"><ul class="alternate"><li><a shape="rect" href="overview.html">Overview</a></li><li><a shape="rect" href="how-tos.html">How-Tos</a></li><li><a shape="rect" href="frontends.html">Frontends</a></li><li><a shape="rect" href="databindings.html">DataBindings</a></li><li><a shape="rect" href="transports.html">Transports</a></li><li><a shape="rect" href="configuration.html">Configuration</a></li><li><a shape="rect" href="debugging-and-logging.html">Debugging and Logging</a></li><li><a shape="rect" href="tools.html">Tools</a></li><li><a shape="rect" href="restful-services.html">RESTful Services</a></li><li><a shape="rect" href="wsdl-bindings.html">WSDL Bindings</a></li><li><a shape="rect" href="service-routing.html">Service Routing</a></li><li><a shape="rect" href="dynamic-languages.html">Dynamic Languages</a></li><li><a shape="rect" href="ws-support.html">WS-* Support</a></li><li><a shape="rect" href="advanced-integration.html">Advanced Integration</a></li><li><a shape
="rect" href="deployment.html">Deployment</a></li><li><a shape="rect" href="schemas-and-namespaces.html">Use of Schemas and Namespaces</a></li><li><a shape="rect" href="securing-cxf-services.html">Securing CXF Services</a></li></ul><hr><ul class="alternate"><li><p>Search</p></li></ul>
+<iframe frameborder="1" scrolling="auto" id="searchId" src="https://cxf.apache.org/resources/search.htm" sandbox="sandbox" name="SearchIFrame" width="200px" style="border:none;" title="Search" height="60px"></iframe>
<hr><ul class="alternate"><li><a shape="rect" href="http://cxf.apache.org/javadoc/latest-4.0.x/">API 4.0.x (Javadoc)</a></li><li><a shape="rect" href="http://cxf.apache.org/javadoc/latest-3.6.x/">API 3.6.x (Javadoc)</a></li><li><a shape="rect" href="http://cxf.apache.org/javadoc/latest-3.5.x/">API 3.5.x (Javadoc)</a></li><li><a shape="rect" href="http://cxf.apache.org/">CXF Website</a></li></ul><p><br clear="none"></p><p><a shape="rect" class="external-link" href="https://www.apache.org/events/current-event.html"> <span class="confluence-embedded-file-wrapper"><img class="confluence-embedded-image confluence-external-resource" draggable="false" src="https://www.apache.org/events/current-event-125x125.png" data-image-src="https://www.apache.org/events/current-event-125x125.png"></span> </a></p></div>
@@ -108,11 +109,11 @@ Apache CXF -- Securing CXF Services
<!-- Content -->
<div class="wiki-content">
<div id="ConfluenceContent"><p><style type="text/css">/*<![CDATA[*/
-div.rbtoc1762018969343 {padding: 0px;}
-div.rbtoc1762018969343 ul {margin-left: 0px;}
-div.rbtoc1762018969343 li {margin-left: 0px;padding-left: 0px;}
+div.rbtoc1781055769193 {padding: 0px;}
+div.rbtoc1781055769193 ul {margin-left: 0px;}
+div.rbtoc1781055769193 li {margin-left: 0px;padding-left: 0px;}
-/*]]>*/</style></p><div class="toc-macro rbtoc1762018969343">
+/*]]>*/</style></p><div class="toc-macro rbtoc1781055769193">
<ul class="toc-indentation"><li><a shape="rect" href="#SecuringCXFServices-Securetransports">Secure transports</a>
<ul class="toc-indentation"><li><a shape="rect" href="#SecuringCXFServices-HTTPS">HTTPS</a></li></ul>
</li><li><a shape="rect" href="#SecuringCXFServices-SecuringJAX-WSservices">Securing JAX-WS services</a>
@@ -211,7 +212,7 @@ div.rbtoc1762018969343 li {margin-left:
<jaxrs:server>
</pre>
-</div></div><p>When one of the limits is reached, the error is returned. JAX-WS consumers will receive 500, JAX-RS/HTTP consumers: 413.</p><p>The following system properties can also be set up for JAX-WS endpoints: "org.apache.cxf.staxutils.innerElementCountThreshold" and "org.apache.cxf.staxutils.innerElementLevelThreshold".</p><p>Please check this <a shape="rect" href="https://cwiki.apache.org/confluence/display/CXF20DOC/JAX-RS+Data+Bindings#JAX-RSDataBindings-ControllingLargeJAXBXMLandJSONinputpayloads">section</a> for the additional information on how JAX-RS JAXB-based providers can be configured.</p><h2 id="SecuringCXFServices-Multiparts">Multiparts</h2><p>It's possible to control various properties associated with caching large attachments via the following per-endpoint contextual properties:</p><div class="table-wrap"><table class="wrapped confluenceTable"><colgroup span="1"><col span="1"><col span="1"></colgroup><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>
Property Name</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Value</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>attachment-memory-threshold</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The threshold value in bytes to switch from memory to file caching. The default value is 1024K.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>attachment-max-size</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The data size in bytes to limit the maximum data size to be cached. Since CXF 3.0.16, 3.1.14, 3.2.1.</p><p>No max size is set by default. When the limits is reached, the error is returned. JAX-WS consumers will receive 500, JAX-RS/HTTP consumers: 413.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>attachment-directory</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The directory name for storing the temporary files. None is specified by default.</p></td></tr><tr><td colspan="1
" rowspan="1" class="confluenceTd"><p>attachment-max-header-size</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The maximum MIME Header Length. The default is 300. This value can also be set by the system property "org.apache.cxf.attachment-max-header-size".</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">attachment-max-count</td><td colspan="1" rowspan="1" class="confluenceTd"><strong>CXF 3.3.4 3.2.11</strong> The maximum number of attachments permitted in a message. The default is 50.</td></tr></tbody></table></div><p>If no per-endpoint contextual properties are specified, then CXF checks any values that are set for the corresponding System properties listed below for large data stream caching and re-uses them for caching attachments.</p><h1 id="SecuringCXFServices-Largedatastreamcaching">Large data stream caching</h1><p>A large stream based message or data will be cached in a temporary file, which is written in the system's temporary directory. You
can change this behavior and other properties of the caching feature by explicitly setting the following properties.</p><p>To change the default behavior for the entire system, you can set the following system properties.</p><div class="table-wrap"><table class="wrapped confluenceTable"><colgroup span="1"><col span="1"><col span="1"></colgroup><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Property Name</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Value</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>org.apache.cxf.io.CachedOutputStream.Threshold</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The threshold value in bytes to switch from memory to file caching. The default value is 128K for CachedOutputStream and 64K for CachedWriter.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>org.apache.cxf.io.CachedOutputStream.MaxSize</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The data size i
n bytes to limit the maximum data size to be cached. No max size is set by default.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>org.apache.cxf.io.CachedOutputStream.OutputDirectory</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The directory name for storing the temporary files. None is specified by default. If specified, the directory must already exist.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>org.apache.cxf.io.CachedOutputStream.CipherTransformation</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The cipher transformation name for encrypting the cached content. None is specified by default.</p></td></tr></tbody></table></div><p>To change the default behavior for a specific bus, you can set the corresponding bus.io.CachedOutputStream properties:</p><div class="table-wrap"><table class="wrapped confluenceTable"><colgroup span="1" class=""><col span="1" class=""><col span="1" class=""></colgroup><tbody cla
ss=""><tr class=""><th colspan="1" rowspan="1" class="confluenceTh"><p>Bus Property Name</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Value</p></th></tr><tr class=""><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="http://bus.io" rel="nofollow">bus.io</a>.CachedOutputStream.Threshold</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The threshold value in bytes to switch from memory to file caching. The default value is 128K for CachedOutputStream and 64K for CachedWriter (corresponds <a shape="rect" class="external-link" href="http://org.apache.cxf.io" rel="nofollow">org.apache.cxf.io</a>.CachedOutputStream.Threshold system property).</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><a shape="rect" class="external-link" href="http://bus.io" rel="nofollow">bus.io</a>.CachedOutputStreamCleaner.Delay</td><td colspan="1" rowspan="1" class="confluenceTd"><p>The delay (in ms) for cleaning up unclosed
CachedOutputStream instances. 30 minutes is specified by default, the minimum value is 2 seconds. If the value of the delay is set to 0 (or is negative), the cleaner will be deactivated.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><a shape="rect" class="external-link" href="http://bus.io" rel="nofollow">bus.io</a>.CachedOutputStreamCleaner.<span style="color: rgb(0,0,0);">CleanOnShutdown</span></td><td colspan="1" rowspan="1" class="confluenceTd"><span style="color: rgb(0,0,0);">Forces cleaning of the unclosed CachedOutputStream instances on Bus shutdown. The default value is "true", if the cleaner is deactivated or the value is set to "false", no cleanup attempt on shutdown will be performed.</span></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><a shape="rect" class="external-link" href="http://bus.io" rel="nofollow">bus.io</a>.CachedOutputStreamCleaner.<span style="color: rgb(0,0,0);">Strategy</span></td><td colspan="1" rowspan="1" class="con
fluenceTd"><p>The strategy to be used for cleaning up unclosed {@code CachedOutputStream} instances. By default, there cleaner implementation creates a timer per each Bus instance. However, in certain deployments it could lead to excessive number of timers being created, so there is an alternative strategy that uses single (static) timer instance. The supported strategies are: <strong>default</strong>, <strong>single-timer</strong>. Since <strong>3.6.9</strong> / <strong>4.0.10</strong> / <strong>4.1.4</strong> releases.</p></td></tr></tbody></table></div><p>In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients). The CachedOutputStreamCleaner bus extension could be used to provide the custom cleaning mechanism for such dangling streams (by default, the extension is implemented by DelayedCachedOutputStreamCleaner and run periodic cleanup set by <a shape="rect" class
="external-link" href="http://bus.io" rel="nofollow">bus.io</a>.CachedOutputStreamCleaner.Delay bus property).</p><p>The encryption option, which is available from CXF 2.6.4 and 2.7.1, uses a symmetric encryption using a generated key and it can be used to protect the cached content from unauthorized access. To enable encryption, the CipherTransformation property can be set to the name of an appropriate stream or 8-bit block cipher transformation (e.g., RC4, AES/CTR/NoPadding, etc) that is supported by the environment. However, it is noted that enabling the encryption will result in an increased processing time and it is therefore recommended only in specific use cases where other means to protect the cached content is unavailable.</p></div>
+</div></div><p>When one of the limits is reached, the error is returned. JAX-WS consumers will receive 500, JAX-RS/HTTP consumers: 413.</p><p>The following system properties can also be set up for JAX-WS endpoints: "org.apache.cxf.staxutils.innerElementCountThreshold" and "org.apache.cxf.staxutils.innerElementLevelThreshold".</p><p>Please check this <a shape="rect" href="https://cwiki.apache.org/confluence/display/CXF20DOC/JAX-RS+Data+Bindings#JAX-RSDataBindings-ControllingLargeJAXBXMLandJSONinputpayloads">section</a> for the additional information on how JAX-RS JAXB-based providers can be configured.</p><h2 id="SecuringCXFServices-Multiparts">Multiparts</h2><p>It's possible to control various properties associated with caching large attachments via the following per-endpoint contextual properties:</p><div class="table-wrap"><table class="wrapped confluenceTable"><colgroup span="1"><col span="1"><col span="1"></colgroup><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>
Property Name</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Value</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>attachment-memory-threshold</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The threshold value in bytes to switch from memory to file caching. The default value is 1024K.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>attachment-max-size</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The data size in bytes to limit the maximum data size to be cached. Since CXF 3.0.16, 3.1.14, 3.2.1.</p><p>The default max size is set to <strong>50Mb</strong> (since <strong>4.2.3</strong>/<strong>4.1.7</strong>, no limit in prior versions). When the limits is reached, the error is returned. JAX-WS consumers will receive 500, JAX-RS/HTTP consumers: 413.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>attachment-directory</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The
directory name for storing the temporary files. None is specified by default.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>attachment-max-header-size</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The maximum MIME Header Length. The default is 300. This value can also be set by the system property "org.apache.cxf.attachment-max-header-size".</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd">attachment-max-count</td><td colspan="1" rowspan="1" class="confluenceTd"><strong>CXF 3.3.4 3.2.11</strong> The maximum number of attachments permitted in a message. The default is 50.</td></tr></tbody></table></div><p>If no per-endpoint contextual properties are specified, then CXF checks any values that are set for the corresponding System properties listed below for large data stream caching and re-uses them for caching attachments.</p><h1 id="SecuringCXFServices-Largedatastreamcaching">Large data stream caching</h1><p>A large stream based
message or data will be cached in a temporary file, which is written in the system's temporary directory. You can change this behavior and other properties of the caching feature by explicitly setting the following properties.</p><p>To change the default behavior for the entire system, you can set the following system properties.</p><div class="table-wrap"><table class="wrapped confluenceTable"><colgroup span="1"><col span="1"><col span="1"></colgroup><tbody><tr><th colspan="1" rowspan="1" class="confluenceTh"><p>Property Name</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Value</p></th></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>org.apache.cxf.io.CachedOutputStream.Threshold</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The threshold value in bytes to switch from memory to file caching. The default value is 128K for CachedOutputStream and 64K for CachedWriter.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>org.apache
.cxf.io.CachedOutputStream.MaxSize</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The data size in bytes to limit the maximum data size to be cached. No max size is set by default.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>org.apache.cxf.io.CachedOutputStream.OutputDirectory</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The directory name for storing the temporary files. None is specified by default. If specified, the directory must already exist.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><p>org.apache.cxf.io.CachedOutputStream.CipherTransformation</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The cipher transformation name for encrypting the cached content. None is specified by default.</p></td></tr></tbody></table></div><p>To change the default behavior for a specific bus, you can set the corresponding bus.io.CachedOutputStream properties:</p><div class="table-wrap"><table class="wrapped co
nfluenceTable"><colgroup span="1" class=""><col span="1" class=""><col span="1" class=""></colgroup><tbody class=""><tr class=""><th colspan="1" rowspan="1" class="confluenceTh"><p>Bus Property Name</p></th><th colspan="1" rowspan="1" class="confluenceTh"><p>Value</p></th></tr><tr class=""><td colspan="1" rowspan="1" class="confluenceTd"><p><a shape="rect" class="external-link" href="http://bus.io" rel="nofollow">bus.io</a>.CachedOutputStream.Threshold</p></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The threshold value in bytes to switch from memory to file caching. The default value is 128K for CachedOutputStream and 64K for CachedWriter (corresponds <a shape="rect" class="external-link" href="http://org.apache.cxf.io" rel="nofollow">org.apache.cxf.io</a>.CachedOutputStream.Threshold system property).</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><a shape="rect" class="external-link" href="http://bus.io" rel="nofollow">bus.io</a>.CachedOutputStreamCl
eaner.Delay</td><td colspan="1" rowspan="1" class="confluenceTd"><p>The delay (in ms) for cleaning up unclosed CachedOutputStream instances. 30 minutes is specified by default, the minimum value is 2 seconds. If the value of the delay is set to 0 (or is negative), the cleaner will be deactivated.</p></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><a shape="rect" class="external-link" href="http://bus.io" rel="nofollow">bus.io</a>.CachedOutputStreamCleaner.<span style="color: rgb(0,0,0);">CleanOnShutdown</span></td><td colspan="1" rowspan="1" class="confluenceTd"><span style="color: rgb(0,0,0);">Forces cleaning of the unclosed CachedOutputStream instances on Bus shutdown. The default value is "true", if the cleaner is deactivated or the value is set to "false", no cleanup attempt on shutdown will be performed.</span></td></tr><tr><td colspan="1" rowspan="1" class="confluenceTd"><a shape="rect" class="external-link" href="http://bus.io" rel="nofollow">bus.io</a>.CachedO
utputStreamCleaner.<span style="color: rgb(0,0,0);">Strategy</span></td><td colspan="1" rowspan="1" class="confluenceTd"><p>The strategy to be used for cleaning up unclosed {@code CachedOutputStream} instances. By default, there cleaner implementation creates a timer per each Bus instance. However, in certain deployments it could lead to excessive number of timers being created, so there is an alternative strategy that uses single (static) timer instance. The supported strategies are: <strong>default</strong>, <strong>single-timer</strong>. Since <strong>3.6.9</strong> / <strong>4.0.10</strong> / <strong>4.1.4</strong> releases.</p></td></tr></tbody></table></div><p>In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients). The CachedOutputStreamCleaner bus extension could be used to provide the custom cleaning mechanism for such dangling streams (by default, the exte
nsion is implemented by DelayedCachedOutputStreamCleaner and run periodic cleanup set by <a shape="rect" class="external-link" href="http://bus.io" rel="nofollow">bus.io</a>.CachedOutputStreamCleaner.Delay bus property).</p><p>The encryption option, which is available from CXF 2.6.4 and 2.7.1, uses a symmetric encryption using a generated key and it can be used to protect the cached content from unauthorized access. To enable encryption, the CipherTransformation property can be set to the name of an appropriate stream or 8-bit block cipher transformation (e.g., RC4, AES/CTR/NoPadding, etc) that is supported by the environment. However, it is noted that enabling the encryption will result in an increased processing time and it is therefore recommended only in specific use cases where other means to protect the cached content is unavailable.</p></div>
</div>
<!-- Content -->
</td>