Skip to main content

Preserving *all* whitespace in incoming SOAP requests?

4 replies [Last post]
ipsi
Offline
Joined: 2009-02-04

I've recently discovered (just today) that Metro/Glassfish/JAX-WS (I have no idea exactly what is responsible for this, but I'd go with Metro?) is removing all whitespace/newlines after the final element in the SOAP message. Thus, a message like

is turned into

That wouldn't be a problem, except that when signing the body it takes into account the whitespace/new lines as well. Thus, when Metro removes those newlines, it changes the signature of the body and verification of the message fails.

I'm using SOAP UI to send requests to my Glassfish V2 UR2 server, running on JDK 1.5, Ubuntu 7.10. Web Service endpoint was generated via wsimport (from an existing WSDL), and is done as a servlet.

First things first, is this due to my Signature Canonicalization? If that's the case, the fix should be relatively simple (use a different one!). C14N in question is . Pretty sure C14N just deals with namespace issues though, so I don't think it's related to that.

Alternatively, is it a problem with the signature algorithm I'm using? It would appear to be

If it's not a problem with the the C14N or the signature, then I guess it's probably Metro doing this? Is this expected behavior, and is it possible to turn it off? I mean, I'm glad that it preserves all the whitespace inside the element, at least, but I would have thought it would be more sensible to preserve all the whitespace inside the body element generally.

Reply viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.
Glen Mazza

I think you need to properly canonicalize[1] your messages *before* having
them signed (I'm not sure of the process/tools for that however, hopefully
an XWSS team member can help here)--just preserving the whitespace at the
client side won't help you, because you normally won't have a guarantee that
intermediate notes would not be doing whitespace stripping of their own.

Even if you preserved the whitespace, you would still have to deal with the
headache of possibly getting converted to someplace
downstream, making your signatures invalid that way.

Glen

[1] http://www.w3.org/TR/xml-c14n11/

metro-3 wrote:
>
> I've recently discovered (just today) that Metro/Glassfish/JAX-WS (I have
> no idea exactly what is responsible for this, but I'd go with Metro?) is
> removing all whitespace/newlines after the final element
> in the SOAP message. Thus, a message like
>
>
>
>
>
>
>
> is turned into
>
> That wouldn't be a problem, except that when signing the body it takes
> into account the whitespace/new lines as well. Thus, when Metro removes
> those newlines, it changes the signature of the body and verification of
> the message fails.
>
> I'm using SOAP UI to send requests to my Glassfish V2 UR2 server, running
> on JDK 1.5, Ubuntu 7.10. Web Service endpoint was generated via wsimport
> (from an existing WSDL), and is done as a servlet.
>
> First things first, is this due to my Signature Canonicalization? If
> that's the case, the fix should be relatively simple (use a different
> one!). C14N in question is > Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>. Pretty sure C14N
> just deals with namespace issues though, so I don't think it's related to
> that.
>
> Alternatively, is it a problem with the signature algorithm I'm using? It
> would appear to be > Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
>
> If it's not a problem with the the C14N or the signature, then I guess
> it's probably Metro doing this? Is this expected behavior, and is it
> possible to turn it off? I mean, I'm glad that it preserves all the
> whitespace inside the element, at least, but I would have
> thought it would be more sensible to preserve all the whitespace inside
> the body element generally.
> [Message sent by forum member 'ipsi' (ipsi)]
>
> http://forums.java.net/jive/thread.jspa?messageID=339953
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@metro.dev.java.net
> For additional commands, e-mail: users-help@metro.dev.java.net
>
>
>

--
View this message in context: http://www.nabble.com/Preserving-*all*-whitespace-in-incoming-SOAP-reque...
Sent from the Metro - Users mailing list archive at Nabble.com.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@metro.dev.java.net
For additional commands, e-mail: users-help@metro.dev.java.net

ipsi
Offline
Joined: 2009-02-04

Sorry for the late response.

Thanks for that. Your answer was reasonably helpful, and brought up a couple of problems I hadn't thought about ( -> ). I don't think this will end up being a problem, as it would appear that the libraries that will be used for sending/receiving/signing the SOAP messages sign and send them, by default, with no whitespace at all. I'll find out for certain if it'll be a problem fairly soon though.

Anyway, thanks for your help.

jessev
Offline
Joined: 2010-08-27

Hi,
Did you ever figure out what the issue was? What was removing the whitespace and/or how to get around it? I also have the same issue.
Thanks,
Jesse

torosg
Offline
Joined: 2008-11-12

Hi

I also have the same problem. Web service server is written in .NET technology (It's a black box). I'm using it's WSDl file to generate java client WS. Calling WS without signing part of XML file is working great. If I include signature info, verification on server side fails.

I beleive the problem is white spaces and new lines between "<SignedInfo>" tags.

Best regards

Tomaz