MTOM and WS-Security (in CXF)

Question

I am using WS-Security (XML-Signature and XML-Encryption) in my Web Service. For larger, binary objects, I intend to use MTOM.

From what I understood is that the binary data is referenced via something like this:

<xop:include href="SomeUniqueID"/>

I see two problems here:

1) How can I include this binary data in the XML-Signature part of the SOAP header?

2) How can I use XML-Encryption (or to be more specific: CXFs standard ways of "automatically" doing XML-Encryption)?

Answer 1

You can include the data in the XML-Signature as if you were not using MTOM. When MTOM is enabled, at first, the data will always be encoded in Base64 and then it will be converted to binary data to send it as a MIME attachment.

CXF will use this temporary Base64 representation of your file to include it in the message signature.