BigDataH2Service - HTTP/2 Big Data Processing Service

The BigDataH2Service showcases HTTP/2 transport benefits for large JSON datasets:

• Large Dataset Processing: Handles JSON datasets from small (1MB) to enterprise-scale (100MB+)
• Automatic Optimization: Selects optimal processing mode based on dataset size
• Memory Efficiency: Streaming and chunked processing for memory-constrained environments
• Performance Metrics: Built-in monitoring for throughput, memory usage, and HTTP/2 optimization indicators
• Security Validation: OWASP ESAPI input validation and HTTPS-only enforcement

The login, if successful, will return a simple token not meant for anything beyond demos. The intent of this guide is to show a place that the JWT and JWE standards can be implemented.

Axis2 JSON support is via POJO Objects. LoginRequest and LoginResponse are coded in the LoginService as the names would indicate. A flag in the supplied axis2.xml file, enableJSONOnly, disables Axis2 functionality not required for JSON and sets up the server to expect JSON.

Security Benefits of enableJSONOnly

The enableJSONOnly parameter provides significant security hardening by enforcing strict JSON-only processing:

• Content-Type Enforcement: Rejects requests without "Content-Type: application/json" header, preventing content-type confusion attacks
• Protocol Restriction: Disables SOAP, XML, and other message formats that could introduce XXE (XML External Entity) vulnerabilities
• Attack Surface Reduction: Eliminates unused Axis2 functionality, reducing potential security vulnerabilities in XML parsing and SOAP processing
• Input Validation: Ensures only well-formed JSON payloads are accepted, preventing malformed request attacks
• Request Filtering: Blocks non-JSON requests at the transport level, providing an additional security barrier

Security Best Practice: When combined with HTTPS-only enforcement (required for HTTP/2), enableJSONOnly creates a secure, hardened API endpoint that accepts only authenticated JSON requests over encrypted connections.

Also provided is a test service, TestwsService. It includes two POJO Objects as would be expected, TestwsRequest and TestwsResponse. This service attempts to return a String with some Javascript, that is HTML encoded by Axis2 and thereby eliminating the possibility of a Javascript engine executing the response i.e. a reflected XSS attack.

Concerning Spring Security and Spring Boot 3, the Axis2Application class that extends SpringBootServletInitializer as typically done utilizes a List of SecurityFilterChain as a binary choice; A login url will match, otherwise invoke JWTAuthenticationFilter. All URL's to other services besides the login, will proceed after JWTAuthenticationFilter verifies the token.

The JWTAuthenticationFilter class expects a token from the web services JSON client in the form of "Authorization: Bearer mytoken".

The Axis2WebAppInitializer class supplied in this guide, is the config class that registers AxisServlet with Spring Boot 3.

Axis2 web services are installed via a WEB-INF/services directory that contains files with an .aar extension for each service. These aar files are similar to jar files, and contain a services.xml that defines the web service behavior. The pom.xml supplied in this guide generates these files.

Tip: don't expose methods in your web services that are not meant to be exposed, such as getters and setters. Axis2 determines the available methods by reflection. For JSON, the message name at the start of the JSON received by the Axis2 server defines the Axis2 operation to invoke. It is recommended that only one method per class be exposed as a starting point. The place to add method exclusion is the services.xml file:

    <excludeOperations>
        <operation>setMyVar</operation>
    </excludeOperations>

The axis2.xml file can define GSON or Moshi as the JSON engine. GSON was the original however development has largely ceased. Moshi is very similar and is widely considered to be the superior implementation in terms of performance. GSON will likely continue to be supported in Axis2 because it is helpful to have two JSON implementations to compare with for debugging.

JSON based web services in the binary distribution of axis2.xml are not enabled by default. See the supplied axis2.xml of this guide, and note the places were it has "moshi". Just replace "moshi" with "gson" as a global search and replace to switch to GSON.

Axis2 web services that are JSON based must be invoked from a client that sets an HTTP header as "Content-Type: application/json". In order for axis2 to properly handle JSON requests, this header behavior needs to be defined in the file WEB-INF/conf/axis2.xml.

    <message name="requestMessage">
        <messageFormatter contentType="application/json"
                          class="org.apache.axis2.json.moshi.JsonFormatter"/>

Other required classes for JSON in the axis2.xml file include JsonRpcMessageReceiver, JsonInOnlyRPCMessageReceiver, JsonBuilder, JSONBasedDefaultDispatcher and JSONMessageHandler.

HTTP/2 Configuration Parameters

• maxConcurrentStreams: Maximum concurrent HTTP/2 streams (default: 100)
• initialWindowSize: HTTP/2 flow control window size (default: 64KB, 2MB recommended for large payloads)
• connectionTimeout: Connection establishment timeout in ms (default: 30000)
• responseTimeout: Timeout for large payload processing (default: 300000 = 5 minutes)
• streamingBufferSize: Buffer size for streaming operations (default: 65536 = 64KB)

Client Usage with cURL

Invoking the client for a login that returns a token can be done as follows:

curl -v -H "Content-Type: application/json" -X POST --data @login.dat http://localhost:8080/axis2-json-api/services/loginService

Where the contents of login.dat are:

{"doLogin":[{"arg0":{"email":"user@example.org","credentials":"userguide"}}]}

Response:

{"response":{"status":"OK","token":"95104Rn2I2oEATfuI90N","uuid":"99b92d7a-2799-4b20-b029-9fbd6108798a"}}

Invoking the client for a Test Service that validates a sample token can be done as follows:

curl -v -H "Authorization: Bearer 95104Rn2I2oEATfuI90N" -H "Content-Type: application/json" -X POST --data @test.dat http://localhost:8080/axis2-json-api/services/testws'

Where the contents of test.dat are below. arg0 is a var name and is used by Axis2 as part of its reflection based code:

{"doTestws":[{"arg0":{"messagein":hello}}]}

Response, HTML encoded to prevent XSS. For the results with encoding see src/site/xdoc/docs/json-springboot-userguide.xml.

{"response":{"messageout":"<script xmlns=\"http://www.w3.org/1999/xhtml\">alert('Hello');</script> \">","status":"OK"}}