secure/encrypt's references, or one that must have arrived encrypted, listed in a validate/decrypt's requiredReferences. Selects the target either by a well-known name (BODY, USERNAME_TOKEN) or by an XPath expression (set xpath; by is then inferred and must be omitted).type decides whether the element itself or only its content is replaced by the xenc:EncryptedData — and, under requiredReferences, which of the two the sender had to have done. The default is derived from the target: the soap:Body is encrypted by CONTENT, because replacing the body element itself would leave an envelope that is no longer valid SOAP, while anything else is encrypted as a whole ELEMENT, so that its name does not stay in the clear.
Syntax
wsSecurity-encrypt-reference:
by: body
id: <string>
type: content
xpath: <string>wsSecurity-encrypt-reference: by: body id: <string> type: content xpath: <string>
Attributes
| Name | Required | Default | Description | Examples |
|---|---|---|---|---|
| by | false | BODY | Which element to encrypt. BODY selects the SOAP body, USERNAME_TOKEN the wsse:UsernameToken inside wsse:Security. Must be omitted when {@link #setXpath(String)} is set — in that case the reference is always resolved by XPath. | - |
| id | false | - | The Id to assign to the xenc:EncryptedData this reference produces, which the xenc:ReferenceList then points at. If omitted, one is generated. Has to be an XML name — a letter or underscore followed by letters, digits, ., - or _ — since that is what the ID type the xenc schema declares allows. Names one element, so a reference carrying it has to select exactly one: an xpath matching several is refused rather than given the same id repeatedly. Only applies when encrypting; it is unused in requiredReferences. | - |
| type | false | - | Whether the xenc:EncryptedData replaces the referenced element's children (CONTENT) or the element itself (ELEMENT). When omitted, BODY uses CONTENT and every other target uses ELEMENT. ELEMENT is not allowed on BODY. | ELEMENT |
| xpath | false | - | XPath expression selecting the element(s) to encrypt. Must match at least one element; when it matches more than one, each matched element is encrypted individually. Setting xpath implies {@link #setBy(By)} is XPATH; by must then be omitted. The soap, wsse, and wsu prefixes are always available; additional prefixes can be declared on the enclosing wsSecurity element's xmlConfig. | //*[local-name()='creditCard'] |