eclipse-ee4j / eclipse-ee4j/metro-wsit

<sp:IncludeTimestamp /> is a binding level assertion, prevents creation of a WS with some secure and some non-secure operations

Open
#233 0 comments 0 reactions 0 assignees View on GitHub
Component: security ERR: Assignee Priority: Major Type: Improvement
Dominant language
Java
Stars
6
Forks
21
Avg merge
10h 2m
Merged PRs (30d)
1

Description

Since the is a Binding level assertion we cannot have a
scenario where some operations of a WebService are secure and some others are
non-secure.

The current workaround is to disable/comment the includeTimestamp assertion, but
a secure message without a Timestamp is not a very good idea so we need some
workaround in wsit to recognize an outside of the
binding(specifically at the Input/Output Message level).
#### Environment
Operating System: All
Platform: All
#### Affected Versions
[current]

Source: [https://github.com/javaee/metro-wsit/issues/710](https://github.com/javaee/metro-wsit/issues/710)
Author: glassfishrobot

Contributor guide

Open the contributing guide

Research direction

Start by tracing how WSIT processes the csp:IncludeTimestamp assertion and how binding-level assertions are applied to operations. Investigate the existing workaround and determine how an assertion at the Input/Output Message level could be recognized. Done means secure and non-secure operations can coexist while secure messages retain timestamps.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.