title: java.lang.RuntimeException: Cannot create a secure XMLInputFactory when deploying on Glassfish
body: <p>I have a web services app developed using CXF 2.7.13. When I deploy on my local Tomcat instance, everything works, but when switching to a glassfish 4 instance, I get the following exception:</p>
  
  <pre><code>java.lang.RuntimeException: Cannot create a secure XMLInputFactory
      at org.apache.cxf.staxutils.StaxUtils.createXMLInputFactory(StaxUtils.java:315)
      at org.apache.cxf.staxutils.StaxUtils.getXMLInputFactory(StaxUtils.java:265)
      at org.apache.cxf.staxutils.StaxUtils.createXMLStreamReader(StaxUtils.java:1701)
      at org.apache.cxf.interceptor.StaxInInterceptor.handleMessage(StaxInInterceptor.java:123)
      at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:272)
      at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)
      at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:241)
      at org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:248)
      at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:222)
      at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:153)
      at org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:171)
      at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:286)
      at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:206)
      at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
      at org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:262)
      at org.apache.catalina.core.StandardWrapper.service(StandardWrapper.java:1682)
      at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:318)
      at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:160)
      at org.apache.catalina.core.StandardPipeline.doInvoke(StandardPipeline.java:734)
      at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:673)
      at com.sun.enterprise.web.WebPipeline.invoke(WebPipeline.java:99)
      at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:174)
      at org.apache.catalina.connector.CoyoteAdapter.doService(CoyoteAdapter.java:357)
      at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:260)
      at com.sun.enterprise.v3.services.impl.ContainerMapper.service(ContainerMapper.java:188)
      at org.glassfish.grizzly.http.server.HttpHandler.runService(HttpHandler.java:191)
      at org.glassfish.grizzly.http.server.HttpHandler.doHandle(HttpHandler.java:168)
      at org.glassfish.grizzly.http.server.HttpServerFilter.handleRead(HttpServerFilter.java:189)
      at org.glassfish.grizzly.filterchain.ExecutorResolver$9.execute(ExecutorResolver.java:119)
      at org.glassfish.grizzly.filterchain.DefaultFilterChain.executeFilter(DefaultFilterChain.java:288)
      at org.glassfish.grizzly.filterchain.DefaultFilterChain.executeChainPart(DefaultFilterChain.java:206)
      at org.glassfish.grizzly.filterchain.DefaultFilterChain.execute(DefaultFilterChain.java:136)
      at org.glassfish.grizzly.filterchain.DefaultFilterChain.process(DefaultFilterChain.java:114)
      at org.glassfish.grizzly.ProcessorExecutor.execute(ProcessorExecutor.java:77)
      at org.glassfish.grizzly.nio.transport.TCPNIOTransport.fireIOEvent(TCPNIOTransport.java:838)
      at org.glassfish.grizzly.strategies.AbstractIOStrategy.fireIOEvent(AbstractIOStrategy.java:113)
      at org.glassfish.grizzly.strategies.WorkerThreadIOStrategy.run0(WorkerThreadIOStrategy.java:115)
      at org.glassfish.grizzly.strategies.WorkerThreadIOStrategy.access$100(WorkerThreadIOStrategy.java:55)
      at org.glassfish.grizzly.strategies.WorkerThreadIOStrategy$WorkerThreadRunnable.run(WorkerThreadIOStrategy.java:135)
      at org.glassfish.grizzly.threadpool.AbstractThreadPool$Worker.doWork(AbstractThreadPool.java:564)
      at org.glassfish.grizzly.threadpool.AbstractThreadPool$Worker.run(AbstractThreadPool.java:544)
      at java.lang.Thread.run(Thread.java:722)]]
  </code></pre>
  
  <p>From what I've read, it seems Woodstox api (woodstox-core-asl.jar) dependency from CXF is conflicting with glassfish's own version of the library. CXF uses Woodstox 4.4.1 while my glassfish 4 instance, I've checked, uses 4.1.2. </p>
  
  <p>So my first attempt was to try and exclude CXF's dependency and declare my own Woodstox 4.1.2 dependency on my POM in order for everyone to use the same version. But this didn't solve the problem.</p>
  
  <p>I also tried straight up removing this dependency from my POM and checked it's not included in the WAR before deploying, also to no avail (same exception).</p>
  
  <p>I've only managed to deploy on glassfish by removing the .jar from the modules dir of the server, but this is somehting I cannot do on my production servers, by requirement. </p>
  
  <p>Is there anything else I can try?</p>