eclipse-ee4j / eclipse-ee4j/metro-wsit
<sp:IncludeTimestamp /> is a binding level assertion, prevents creation of a WS with some secure and some non-secure operations
- Dominant language
- Java
- Stars
- 6
- Forks
- 21
- Avg merge
- 10h 2m
- Merged PRs (30d)
- 1
Description
Since the is a Binding level assertion we cannot have a
scenario where some operations of a WebService are secure and some others are
non-secure.
The current workaround is to disable/comment the includeTimestamp assertion, but
a secure message without a Timestamp is not a very good idea so we need some
workaround in wsit to recognize an outside of the
binding(specifically at the Input/Output Message level).
#### Environment
Operating System: All
Platform: All
#### Affected Versions
[current]
Source: [https://github.com/javaee/metro-wsit/issues/710](https://github.com/javaee/metro-wsit/issues/710)
Author: glassfishrobot
Contributor guide
Research direction
Start by tracing how WSIT processes the csp:IncludeTimestamp assertion and how binding-level assertions are applied to operations. Investigate the existing workaround and determine how an assertion at the Input/Output Message level could be recognized. Done means secure and non-secure operations can coexist while secure messages retain timestamps.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100