在 CXF 记录 SOAP 请求中屏蔽敏感数据

Question

After using CXF to call a SOAP webservice, CXF client logs the SOAP request message with password visible! I want to hide sensitive data like passwords from the CXF client logging.

Here's what I got in log:

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <runReport xmlns="http://xmlns.oracle.com/oxp/service/MYSERVICE">
       <userID>username</userID>
       <password>mypassword</password>
    </runReport>
  </soap:Body>
</soap:Envelope>

All I want is to replace mypassword to **********

I tried this solution but it won't work with my CXF version because it uses an older version of CXF.

I really saw many examples, ones that extends LoggingOutInterceptor, other extends AbstractSoapInterceptor, other extends PhaseInterceptorChain and others... and I really don't know where to start, I couldn't find any documentation on this matter.

Any help, link to doc will be appreciated!

Answer 1

I solved this extending LoggingInInterceptor and adding the words that i want to hide in the method addSensitiveElementNames, for header they have sensitiveProtocolHeaderNames method to do the same.

  public class MyLogIn extends LoggingInInterceptor {
    
      public void handleMessage(Message message) throws Fault {
         addSensitiveElementNames(Set.of("description"));
         super.handleMessage(message);
      }
 }

I found some info in this site