title: How to disable SOAP 1.1 binding with Apache CXF
body: <p>In a Java/Spring/Apache CXF application, I have a SOAP endpoint defined like this:</p>
  
  <pre><code>&lt;cxf:endpoint
      id="MessagingService"
      address="/MessagingService"
      bindingUri="http://www.w3.org/2003/05/soap/bindings/HTTP/"
      implementor="mypackage.MessagingServiceImpl" /&gt;
  </code></pre>
  
  <p>The attribute <code>bindingUri="http://www.w3.org/2003/05/soap/bindings/HTTP/"</code> enables SOAP 1.2 bindings. I've tested, it works.</p>
  
  <p>Some people considers there is a security issue with SOAP 1.1 by "expanding XML entities". I would like to protect my WebService from this kind of attack.</p>
  
  <p>Not sure my question makes sense but: is it possible to "disable" SOAP 1.1 binding?</p>
  
  <p>NB: from my perspective, what makes the difference between SOAP 1.1 and SOAP 1.2 requests is the XML namespace <code>http://schemas.xmlsoap.org/soap/envelope/</code> used in SOAP 1.1 requests and <code>http://www.w3.org/2003/05/soap-envelope</code> used in SOAP 1.2 requests. "Disabling" SOAP 1.1 binding could mean: reject any SOAP request using the SOAP 1.1 namespace</p>
  
  <p>Thanks in advance</p>