CXF Web Services Regulation

Question

I'm new to CXF, and I would like to know if it has a build mechanism that will limit the number of simultaneous calls to the web service, thus considering the possibility of a DoS attack? Something similar to this feature of WCF?

http://www.danrigsby.com/blog/index.php/2008/02/20/how-to-throttle-a-wcf-service-help-prevent-dos-attacks-and-maintain-wcf-scalability/

Answer 1

CXF has some ability to do some of this out of the box. CXF endpoints can have a factory configured to invoker, which is used to get the object that is being called. Out of the box is PooledFactory , which can support a pool of instances. It can be configured to not create additional instances outside of max and therefore wait until it is freed. This may give a little push. You can configure this using spring configuration or using annotation on impl:

 @FactoryType(value=FactoryType.Type.POOLED, args={"25"}) 

(25 - maximum pool size)

However, it is very late to process. By the time he reaches this, all of the XML has been parsed, jaxb objects created, etc. For DOS, you probably want to stop earlier. You can implement an interceptor that will live at the beginning of the chain, which will store the account stored on the endpoint. Increase and check the incoming chain, decrease on the outgoing chain.