Spring/spring-ws
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Propagate TTL in Wss4jSecurityInterceptor.

Browse Source 
Ensure TTL values are propagated properly through Wss4j's security interceptor.

Resolves #1150.
Original pull request: #1185.
This commit is contained in:
Jamin Hitchcock
2021-03-11 21:59:25 -06:00
committed by Greg L. Turnquist
parent d260339814
commit ffe5ccbdb5
2 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java
View File

@@ -689,7 +689,13 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
requestData.setCallbackHandler(validationCallbackHandler);
messageContext.setProperty(WSHandlerConstants.TIMESTAMP_STRICT, timestampStrict);
messageContext.setProperty(WSHandlerConstants.TTL_TIMESTAMP, Integer.toString(validationTimeToLive));
messageContext.setProperty(WSHandlerConstants.TTL_FUTURE_TIMESTAMP, Integer.toString(futureTimeToLive));
requestData.setTimeStampStrict(timestampStrict);
requestData.setTimeStampTTL(validationTimeToLive);
requestData.setTimeStampFutureTTL(futureTimeToLive);
requestData.setAllowRSA15KeyTransportAlgorithm(allowRSA15KeyTransportAlgorithm);

16
spring-ws-security/src/test/java/org/springframework/ws/soap/security/wss4j2/Wss4jMessageInterceptorTimestampTestCase.java
View File

@@ -74,6 +74,22 @@ public abstract class Wss4jMessageInterceptorTimestampTestCase extends Wss4jTest
});
}
@Test
public void testValidateTimestampWithExpiredTtlCustomTtl() throws Exception {
assertThatExceptionOfType(WsSecurityValidationException.class).isThrownBy(() -> {
Wss4jSecurityInterceptor interceptor = new Wss4jSecurityInterceptor();
interceptor.setValidationActions("Timestamp");
interceptor.setValidationTimeToLive(1);
interceptor.afterPropertiesSet();
SoapMessage message = getMessageWithTimestamp();
Thread.sleep(2000);
MessageContext context = new DefaultMessageContext(message, getSoap11MessageFactory());
interceptor.validateMessage(message, context);
});
}
@Test
public void testSecureTimestampWithCustomTtl() throws Exception {