Quarkus CXF 3.38.0 release notes
Important dependency upgrades
-
Quarkus 3.37.x → 3.38.0 - release notes
Enhancements
New WS-Addressing decoupled endpoint configuration options
New configuration options were introduced to make Quarkus CXF work with the changes in Apache CXF PR #3279:
-
quarkus.cxf.endpoint.addressing.decoupled.enabled - if
true, WS-Addressing decoupled destinations (non-anonymouswsa:ReplyToorwsa:FaultTo) requested by clients will be honored; otherwise, any request will result inDestinationUnreachablefault to prevent Server-Side Request Forgery (SSRF). -
quarkus.cxf.endpoint.addressing.decoupled.allowed-schemes - list of URI scheme prefixes permitted in
wsa:ReplyToandwsa:FaultTodecoupled-destination addresses.
These options replace the system properties org.apache.cxf.ws.addressing.decoupled.enabled
and org.apache.cxf.ws.addressing.decoupled.allowedSchemes used by plain CXF.
Unlike plain CXF, Quarkus CXF allows only http:// and https:// by default.
Bugfixes
Make sure the client sends WS-Addressing headers if the WSDL requires it
Before Quarkus CXF 3.38.0, when a WSDL required WS-Addressing, the client did not always send the required WS-Addressing headers. Since Quarkus CXF 3.38.0, the client correctly sends WS-Addressing headers if the WSDL requires it.