title: Disable Jax-WS Apache CXF HTTPConduit Message Logging
body: <p>I've been stuck on this one the last couple of days to no avail and after a lot of googling and trial and error I'm back at the beginning with no luck.</p>
  
  <p>I'm currently working on a Java Application which connects to a third party via JAX-WS. They provide a WSDL which we run in using the jaxws-maven-plugin to generate the services. Implemented via Spring, HTTPConduit is then used to change the endpoints and provide relevant config (e.g. keystores) for connecting to various environments (e.g. SysTest, UAT, Production etc).</p>
  
  <p>The issue is, I haven't set any logging (in fact removing the two interceptors there previously), however the xml message being sent to the third party is appearing in the logs. This is a major issue as we're sending credit card information to the third parties which can no way be logged for obvious reasons. I can change the log4j properties in order to prevent the logging that way, but that's no way a fix.</p>
  
  <p>Here is some code:
  This is our beans file. </p>
  
  <pre><code>&lt;jaxws:client id="client1"
                xmlns:hsn="http://example.com"
                serviceClass="com.example.Service1"
                address="${service1.url}"
                endpointName="hsn:service1"/&gt;
  
  &lt;jaxws:client id="client2"
                xmlns:hsn="http://example.com"
                serviceClass="com.example.Service2"
                address="${service2.url}"
                endpointName="hsn:service2"/&gt;
  
  &lt;jaxws:client id="client3"
                xmlns:hsn="http://example.com"
                serviceClass="com.example.Service3"
                address="${service3.url}"
                endpointName="hsn:service3"/&gt;
  
  &lt;http:conduit name="https://*/.*"&gt;
      &lt;http:tlsClientParameters disableCNCheck="${service.disable-cn-check}"&gt;
          &lt;sec:keyManagers keyPassword="${service.keystore.password}"&gt;
              &lt;sec:keyStore type="JKS" password="${service.keystore.password}"
                            resource="${service.keystore.name}"/&gt;
          &lt;/sec:keyManagers&gt;
          &lt;sec:trustManagers&gt;
              &lt;sec:keyStore type="JKS" password="${service.truststore.password}"
                            resource="${service.truststore.name}"/&gt;
          &lt;/sec:trustManagers&gt;
          &lt;sec:cipherSuitesFilter&gt;
              &lt;sec:include&gt;.*_EXPORT_.*&lt;/sec:include&gt;
              &lt;sec:include&gt;.*_EXPORT1024_.*&lt;/sec:include&gt;
              &lt;sec:include&gt;.*_WITH_DES_.*&lt;/sec:include&gt;
              &lt;sec:include&gt;.*_WITH_AES_.*&lt;/sec:include&gt;
              &lt;sec:include&gt;.*_WITH_NULL_.*&lt;/sec:include&gt;
              &lt;sec:exclude&gt;.*_DH_anon_.*&lt;/sec:exclude&gt;
          &lt;/sec:cipherSuitesFilter&gt;
      &lt;/http:tlsClientParameters&gt;
      &lt;http:client AutoRedirect="true" Connection="Keep-Alive"
                   ConnectionTimeout="${service.max-response-time}"
                   ReceiveTimeout="${service.max-response-time}"/&gt;
  
  &lt;/http:conduit&gt;
  
  &lt;http:conduit name="http://*/.*"&gt;
      &lt;http:client AutoRedirect="true" Connection="Keep-Alive"
                   ConnectionTimeout="${service.max-response-time}"
                   ReceiveTimeout="${service.max-response-time}"/&gt;
  &lt;/http:conduit&gt;
  </code></pre>
  
  <p>As you can see there are no logging interceptors or logging explicitly turned on using:</p>
  
  <pre><code>&lt;cxf:bus&gt;
      &lt;cxf:features&gt;
          &lt;cxf:logging/&gt;
      &lt;/cxf:features&gt;
  &lt;/cxf:bus&gt;
  </code></pre>
  
  <p></p>
  
  <p>The only other related file I can think of is META-INF/cxf/org.apache.cxf.Logger which contains:</p>
  
  <p>org.apache.cxf.common.logging.Slf4jLogger</p>
  
  <p>Which even without the file present doesn't make any changes.</p>
  
  <p>Just so you can see, here is a sample from the logs as well:</p>
  
  <pre><code>15:05:45.742 DEBUG | org.apache.cxf.phase.PhaseInterceptorChain  - Invoking handleMessage on interceptor org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor@5e62b59d
  15:05:45.742 DEBUG | org.apache.cxf.transport.http.Headers  - Accept: */*
  15:05:45.743 DEBUG | org.apache.cxf.transport.http.Headers  - Connection: Keep-Alive
  15:05:45.743 DEBUG | org.apache.cxf.transport.http.Headers  - SOAPAction: ""
  15:05:45.744 DEBUG | org.apache.cxf.transport.http.HTTPConduit  - No Trust Decider for Conduit '{http://example.com}service1.http-conduit'. An afirmative Trust Decision is assumed.
  15:05:45.746 DEBUG | org.apache.cxf.transport.http.HTTPConduit  - Sending POST Message with Headers to http://localhost:8080/stubs/Service1 Conduit :{http://example.com}service1.http-conduit
  
  15:05:45.746 DEBUG | org.apache.cxf.transport.http.HTTPConduit  - Conduit "{http://example.com}service1.http-conduit" Transmit cached message to: http://localhost:8080/stubs/Service1: &lt;soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"&gt;&lt;soap:Body&gt;********************HERE LIES THE XML MESSAGE*********************&lt;/soap:Body&gt;&lt;/soap:Envelope&gt;
  15:05:45.766 DEBUG | org.apache.cxf.endpoint.ClientImpl  - Interceptors contributed by bus: [org.apache.cxf.ws.policy.PolicyInInterceptor@24ec87dc]
  15:05:45.767 DEBUG | org.apache.cxf.endpoint.ClientImpl  - Interceptors contributed by client: []
  15:05:45.767 DEBUG | org.apache.cxf.endpoint.ClientImpl  - Interceptors contributed by endpoint: [org.apache.cxf.jaxws.interceptors.WrapperClassInInterceptor@52d1f1fb, org.apache.cxf.jaxws.interceptors.HolderInInterceptor@5565c037, org.apache.cxf.jaxws.interceptors.SwAInInterceptor@b2e86ae, org.apache.cxf.frontend.WSDLGetInterceptor@1ca801a2]
  15:05:45.768 DEBUG | org.apache.cxf.endpoint.ClientImpl  - Interceptors contributed by binding: [org.apache.cxf.interceptor.AttachmentInInterceptor@1b8c0f3e, org.apache.cxf.interceptor.StaxInInterceptor@83cbd93, org.apache.cxf.binding.soap.interceptor.SoapActionInInterceptor@4bc2021e, org.apache.cxf.interceptor.DocLiteralInInterceptor@2e19266d, org.apache.cxf.binding.soap.interceptor.SoapHeaderInterceptor@7529d5bf, org.apache.cxf.binding.soap.interceptor.ReadHeadersInterceptor@d902ab1, org.apache.cxf.binding.soap.interceptor.StartBodyInterceptor@73e2d16b, org.apache.cxf.binding.soap.interceptor.CheckFaultInterceptor@3023033d, org.apache.cxf.binding.soap.interceptor.MustUnderstandInterceptor@4aa9b27b]
  15:05:45.768 DEBUG | org.apache.cxf.endpoint.ClientImpl  - Interceptors contributed by databinging: [org.apache.cxf.jaxb.attachment.JAXBAttachmentSchemaValidationHack@331fef77]
  15:05:45.769 DEBUG | org.apache.cxf.phase.PhaseInterceptorChain  - Chain org.apache.cxf.phase.PhaseInterceptorChain@273221e was created. Current flow:
    receive [PolicyInInterceptor, AttachmentInInterceptor]
    post-stream [StaxInInterceptor]
    read [WSDLGetInterceptor, ReadHeadersInterceptor, SoapActionInInterceptor, StartBodyInterceptor]
    pre-protocol [MustUnderstandInterceptor]
    post-protocol [CheckFaultInterceptor, JAXBAttachmentSchemaValidationHack]
    unmarshal [DocLiteralInInterceptor, SoapHeaderInterceptor]
    post-logical [WrapperClassInInterceptor]
    pre-invoke [SwAInInterceptor, HolderInInterceptor]
  
  15:05:45.769 DEBUG | org.apache.cxf.phase.PhaseInterceptorChain  - Invoking handleMessage on interceptor org.apache.cxf.ws.policy.PolicyInInterceptor@24ec87dc
  </code></pre>